Splunk Search

How to create multiple reports/pdf output from a single search?

koshyk
Super Champion

hi folks, we got a requirement to create xx number of reports based on a filter.
For example the lookup file has filter of team

TeamName,sourcetype
Windows,windows:*
Unix,syslog
Oracle,oracle*

We have a single search to grab the data , but based on the lookup, I need to xx reports based on TeamName Split the PDF/report within the result. So while sending, it needs to be in xx reports (3 in above case). Windows.pdf, unix.pdf, Oracle.pdf and so on

Is it possible to do? Or do we need xx number of searches to do this? (please note, our requirement is about 70 such groups which makes it 70 individual searches otherwise)

0 Karma
1 Solution

niketn
Legend

@koshyk can you try the following

| inputlookup team_data.csv
| map maxsearches=100 search="| tstats count where index=_internal AND sourcetype IN ("$sourcetype$") by sourcetype
| eval emailFieldForTest=\"$email$\"
| sendemail to=\"$email$\" format=\"html\" server=smtp.abc.com:123 use_tls=1 subject=\"Alert for $TeamName$\" message=\"This is an alert for $TeamName$\" sendpdf=true"

The search query returns result only sourcetype for specific team at a time. The sendemail command uses $email$ passed through map command.

PS: You can remove sendemail command to test whether emailFieldForTest is being populated with correct email or not. When you get this to working you can get rid of emailFieldForTest field.

Team data for above example is based on Splunk's _internal index which prepares the lookup similar to yours for splunkd, access and mongodb sourcetypes in Splunk's _internal index.

| makeresults
| fields - _time
| eval data="splunkd,splunkd,splunkd_support@somewhere.com;access,*access*,access_support@somewhere.com;mongodb,mongodb,mongodb_support@somewhere.com"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval TeamName=mvindex(data,0),sourcetype=mvindex(data,1),email=mvindex(data,2)
| table TeamName sourcetype email
| outputlookup team_data.csv
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@koshyk can you try the following

| inputlookup team_data.csv
| map maxsearches=100 search="| tstats count where index=_internal AND sourcetype IN ("$sourcetype$") by sourcetype
| eval emailFieldForTest=\"$email$\"
| sendemail to=\"$email$\" format=\"html\" server=smtp.abc.com:123 use_tls=1 subject=\"Alert for $TeamName$\" message=\"This is an alert for $TeamName$\" sendpdf=true"

The search query returns result only sourcetype for specific team at a time. The sendemail command uses $email$ passed through map command.

PS: You can remove sendemail command to test whether emailFieldForTest is being populated with correct email or not. When you get this to working you can get rid of emailFieldForTest field.

Team data for above example is based on Splunk's _internal index which prepares the lookup similar to yours for splunkd, access and mongodb sourcetypes in Splunk's _internal index.

| makeresults
| fields - _time
| eval data="splunkd,splunkd,splunkd_support@somewhere.com;access,*access*,access_support@somewhere.com;mongodb,mongodb,mongodb_support@somewhere.com"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval TeamName=mvindex(data,0),sourcetype=mvindex(data,1),email=mvindex(data,2)
| table TeamName sourcetype email
| outputlookup team_data.csv
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

koshyk
Super Champion

thank you mate. I've got the idea. will accept it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...