Splunk Search

How do I email customized stats tables to individual employees?

matthewg
Explorer

I want to send an alert to each Employee once a day with a stats table customized to that employee: for instance the search looks similar to:

user="username" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer

How can I divide this into multiple tables, one for each username that splunk finds and send each user their own table?

I know that I can use the variable $result.user$ in my alert in the To: field like $result.user$@ourdomain.com

I want to send a customized table to each user. So james@ourdomain.com would receive the results of
user="james" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
but jill@ourdomain.com would receive the results of
user="jill" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
etc.

Since there are several hundred users and they come and go the alert should just generate a table for each user that it finds and attempt to email the results to that user.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...