Splunk Search

How do I email customized stats tables to individual employees?

matthewg
Explorer

I want to send an alert to each Employee once a day with a stats table customized to that employee: for instance the search looks similar to:

user="username" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer

How can I divide this into multiple tables, one for each username that splunk finds and send each user their own table?

I know that I can use the variable $result.user$ in my alert in the To: field like $result.user$@ourdomain.com

I want to send a customized table to each user. So james@ourdomain.com would receive the results of
user="james" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
but jill@ourdomain.com would receive the results of
user="jill" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
etc.

Since there are several hundred users and they come and go the alert should just generate a table for each user that it finds and attempt to email the results to that user.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...