I have a very simple search saved as a Scheduled E-mail Report. When I manually run the search it works as expected. The scheduled e-mail report only contains the first entry or I've also received separate e-mails each containing a row from the report.
The search string ends with | top limit=20 field_name_here
Is there something I don't realize about the top command that would affect scheduled reports?
Thank you!
Hello,
I suspect the Alert mode
parameter in Alert definition, it could be: Once per search
or Once per result
.
Set it to Once per search
and check the behavior, you can do from Web interface or from savedsearches.conf
:
alert.digest_mode = True
Regards
Hello,
I suspect the Alert mode
parameter in Alert definition, it could be: Once per search
or Once per result
.
Set it to Once per search
and check the behavior, you can do from Web interface or from savedsearches.conf
:
alert.digest_mode = True
Regards
How do I check the Alert definition for a Report via the web interface (6.5.2) ? I can't seem to find anything about "Alert" for this Report....
Settings -> Searches, reports, and alerts -> Click the alert under Search name column -> Alert mode
Is your Alert mode set as Once per result?
Can you share the search and other alert options you set in report?
try just |top 20 field_name_here
This did not help unfortunately. Same behavior.