Reporting

Retrive configured Index name via sendemail.py

ppurokit
Path Finder

Hi All,

I have some set of dashboards created and i have added some search queries as part of the dashboard.

I need to schedule the dashboards for every 1 hr. Hence i make use of the option "Schedule PDF Delivery" and give email ids to which my PDF needs to be delivered.

Since the pdf file name needs to be in a specific format , i modified the sendemail.py to make the pdf file name look something like

CPY Duration Report Type Date_format

Where:
CPY - is the company id

Duration - one of the following values: Daily, Weekly, Monthly

Report_Type: the report name

Date_Format: yyyyMMddhhmmss

As of now i have hardcoded the company id. Example: "splunk"
I will be using the same company name as my index name.

I know indexes.conf has all the index names, but i cant reply on it since i may have multiple indexes.conf for different apps installed.

"/opt/splunk/var/lib/splunk" folder has all the indexes configured.

Is there any piece of code or a unique property file or anything programmatic way in which i will be able to get the configured indexes and use it in the sendemail.py.

0 Karma

yannK
Splunk Employee
Splunk Employee

How do you know which index is related to which scheduled dashboard ?

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...