Send all reports from last hour in an email

[kirthi_d]

Hello everyone,
current scenario:
Reports run every 15 minutes. The output are charts. We take screenshot of those reports and manually send email every one hour with screen shots from past hour. For instance at 10am, we send email with 4 screenshots from 9:00, 9:15, 9:30, 9:45.

My manager wants me to automate this. The reports from past hour should be saved and sent in a single email every hour. Please let me know if and how this can be achieved.

Thanks in advance.

[to4kawa · Accepted solution]

index=_internal earliest=-1h@h
| bin _time span=15m
| eval time=strftime(_time,"%T")
| stats count by sourcetype time
| eval {time}=count
| fields - count
| sort time
| where strptime(time,"%T") < relative_time(now(),"@h")

this is sample.
use Viz >>column chart with trellis of time.

[kirthi_d]

Thanks to4kawa. This generates one single report. I need 4 instances of same report to be sent in one email. Is it possible to store results of a report in splunk and use it later?

For instance, "Sales Report" ran at 9am is saved as report1, the same "Sales Report" ran again at 9,15am saved as report2 and "Sales Report" ran at 9.30 saved as report3 and ran at 9.45 saved as report 4. And an email triggered at 9.45 with report1 through report4 either attached or displayed in the body?

Appreciate your help

[to4kawa]

It's impossible by only splunk.

so, I make the query to display 4 chart.

[kirthi_d]

Thought so too. Wanted to confirm with experts before saying No. Thanks again.

[to4kawa]

If there were four graphs, wouldn't the boss be convinced?

I hope it works out for you. please accept and close your question.

[kirthi_d]

I see what you mean, I can generate 4 reports and put in dashboard and schedule to email that. That could work. Thanks