How do I add search results to lookup AND send entire lookup by email?

[spadler]

I was asked to archive search results in a CSV then send those results periodically by email. My solution is to do this in 2 reports. The first report runs the search and appends the results to a lookup. The second just grabs the entire lookup (| inputlookup my_lookup.csv) then emails the results as a CSV. 

This seems to work fine but I feel like there should be a more elegant solution, like in only one search/report. I'm curious about what others think. 

[nyc_jason]

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup:

mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com"  sendcsv=true

See these docs:

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail

[schose]

hi,

This sounds like a working solution. Me personally would first try to create an alert instead of report and set the trigger to "send email" there you can select "attach CSV".. should do the same with one object to maintain.

best regards,

Andreas

[gcusello]

Hi @spadler,

the searches in both report and add lookup I suppose are the same.

So you could run your search in an alert, sending the csv as attachment and adding at the end of the search the outputlookup command that saves the search results in a lookup.

In this way you have with one search both the lookup and the attachement because the outputlookup doesn't change the results to send as alert attachement.

Ciao.

Giuseppe

[spadler]

I tried your suggestion with the following in an alert. While it performs the search, updates the lookup, and sends the lookup CSV by email, it overwrites the lookup data. I need it to append the latest search results to the lookup, then send the updated CSV by email. 

MY_SEARCH
|timechart span=10m count BY status
| outputlookup my_lookup.csv

[gcusello]

Hi @spadler,

please try this:

MY_SEARCH
| append [ | inputlookup your_lookup.csv | fields _time status count ]
| timechart span=10m count BY status
| outputlookup my_lookup.csv

Otherwise, the only solution is two different objects.

Ciao.

Giuseppe