Splunk Search

How do I email customized stats tables to individual employees?

matthewg
Explorer

I want to send an alert to each Employee once a day with a stats table customized to that employee: for instance the search looks similar to:

user="username" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer

How can I divide this into multiple tables, one for each username that splunk finds and send each user their own table?

I know that I can use the variable $result.user$ in my alert in the To: field like $result.user$@ourdomain.com

I want to send a customized table to each user. So james@ourdomain.com would receive the results of
user="james" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
but jill@ourdomain.com would receive the results of
user="jill" result="hit" OR result="miss" | stats earliest(_time), count, dc(result), max(score) by referer
etc.

Since there are several hundred users and they come and go the alert should just generate a table for each user that it finds and attempt to email the results to that user.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...