Sorry Flynt, I never received anything, and I can't see any way to email you via Splunk> answers. Am I overlooking something. ... View more

Thanks Flynt, and yes I'd be interested in trying out the unpublished version with encryption. How can we make the arrangement? ... View more

Thank you Somesoni2. (And btw, congratulations on the Splunk 2016-17 MVP award!) I managed to get a proof of concept working for this by scheduling the two lookups as described above, with some additional settings described below. For the sake of other readers it was important to also do the following: The second scheduled job using the second (shorter) query above, should be scheduled to run Earliest: -5m@m, Latest: now, Basic search very 5 minutes. Do not make it real time, I created a flood of email for a single event by doing that. The notification email uses the $RESULT.userName$@yourdomain.com as the recipient of the email message. This will pull out the username from the lookup and use it to send the email directly to each user. (Replace with your own field as it appropriate). Configure the email alert to fire for each result. The email alert should use suppression (throttle) with the asterisk "*", for 15 minutes, to prevent multiple alerts being sent if someone quickly logs on/off/on a new computer within a span of < 5 minutes. This will ensure that if the user does this they will only receive a single email for that host. The suppression time of 15 minutes will also give the first scheduled search job a chance to update the CSV file, and avoid sending a duplicate email for the same host 5 minutes later. I did figure out how to use the Backfill python script (not that hard), but it requires you to have a separate index available to use when you run it. It was very slow to run the backfill but it did finish eventually, and you can actually disable the index when you're done as you don't need it to run this solution, you only need it for back filling. If you don't care about back filling then you don't need the extra temporary index and no need to run the backfill python script, just schedule your search jobs, and let it start building the CSV over time. You can always disable/enable the email alerts when you're ready to notify end users. ... View more