Splunk Report Delivery

[Roy_9]

Hello,

I have a report scheduled every week and the results are exported to pdf's. Is there an option to NOT email if no results are found because sometimes these PDF's have nothing in them.

Thanks

[Jawahir]

You can achieve this by using the sendemail command.

Rather than setting email as an action, you can incorporate the sendemail command directly into your search query, configuring it with the necessary parameters.

Example

<yoursearch> | sendemail to=example@splunk.com server=mail.example.com 
subject="Here is an email from Splunk" message="This is an example message" 
sendresults=true inline=true format=raw sendpdf=true

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[richgalloway]

There is no such option because reports are sent unconditionally.

If you wish to send email only when there are results then consider changing the report to an alert.