Getting Data In

No Data reports- any way to not send email?

zindain24
Path Finder

Looking for a way to prevent Splunk from sending an email with a blank report. In our case certain reports run every hour and are often empty. My customers are asking for a way to stop these "No Data" emails. Anyone have a suggestion? Thanks!

Tags (1)
0 Karma
1 Solution

Takajian
Builder

I think you can configure alert condition to prevent Splunk from sending when search result is no data. The setting will be "Trigger if Number of results is more than 0 ". You can refer to following manual. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/user/SchedulingSavedSearches

View solution in original post

0 Karma

Takajian
Builder

I think you can configure alert condition to prevent Splunk from sending when search result is no data. The setting will be "Trigger if Number of results is more than 0 ". You can refer to following manual. Hope this help.

http://docs.splunk.com/Documentation/Splunk/latest/user/SchedulingSavedSearches

0 Karma

rafaelschwed
New Member

Setting the trigger does not work, still sends the blank report.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...