Is there a way within Splunk to schedule the delivery of a personalized dashboard report to multiple different users?
I'm trying to write a user activity report. I've got the dashboard created, but I can't find a good solution for iterating through user accounts and delivering reports to each account owner of their data.
Ex: Pull from a lookup a list of user accounts and associated email addresses, then run the dashboard for each account and deliver the results to the associated email addresses.
First you save the search results using outputcsv
. In a separate search you load in your lookup using inputlookup
and then pass this to map
to iterate over it calling inputcsv
to load back in the original data and use sendmail
to send to each user.