Splunk Search

How do I add search results to lookup AND send entire lookup by email?

spadler
Explorer

I was asked to archive search results in a CSV then send those results periodically by email. My solution is to do this in 2 reports. The first report runs the search and appends the results to a lookup. The second just grabs the entire lookup (| inputlookup my_lookup.csv) then emails the results as a CSV. 

This seems to work fine but I feel like there should be a more elegant solution, like in only one search/report. I'm curious about what others think. 

Labels (1)
0 Karma

nyc_jason
Splunk Employee
Splunk Employee

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup:

mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com"  sendcsv=true

See these docs:

https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail

 

0 Karma

schose
Builder

hi,

This sounds like a working solution. Me personally would first try to create an alert instead of report and set the trigger to "send email" there you can select "attach CSV".. should do the same with one object to maintain.

best regards,

Andreas

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spadler,

the searches in both report and add lookup I suppose are the same.

So you could run your search in an alert, sending the csv as attachment and adding at the end of the search the outputlookup command that saves the search results in a lookup.

In this way you have with one search both the lookup and the attachement because the outputlookup doesn't change the results to send as alert attachement.

Ciao.

Giuseppe

spadler
Explorer

I tried your suggestion with the following in an alert. While it performs the search, updates the lookup, and sends the lookup CSV by email, it overwrites the lookup data. I need it to append the latest search results to the lookup, then send the updated CSV by email. 

 

MY_SEARCH
|timechart span=10m count BY status
| outputlookup my_lookup.csv

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spadler,

please try this:

MY_SEARCH
| append [ | inputlookup your_lookup.csv | fields _time status count ]
| timechart span=10m count BY status
| outputlookup my_lookup.csv

Otherwise, the only solution is two different objects.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...