Alerting

Remove Search query from the email Alert

sunilsk1
Path Finder

I have scheduled a email alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

Tags (2)
0 Karma

DerekB
Splunk Employee
Splunk Employee

Starting in Splunk 6.1, this ability is built into the product. Edit your search and look under the "Click to edit email action" link in the "Alert Actions" section. It's a simple check box you can uncheck. It's in the picture in step 4.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Setupalertactions

sunilsk1
Path Finder

Instead of making any changes to the python script. you can use the following if you need an email everytime the search is executed.

You can disable the Email alert(uncheck the checkbox for Email) and add the following to your Splunk search query -
|sendemail to="@mailid.com" format=html subject=myresults server=mail.splunk.com sendresults=true

if it throws any error then remove the server info from the search : |sendemail to="@mailid.com" format=html subject=myresults sendresults=true

If the alert condition is met then the

dyork
Engager

Worked a treat!
Thanks mate

0 Karma

lcrielaa
Communicator

A quick search turned up the following question that someone asked earlier:

http://answers.splunk.com/answers/31388/email-report-format

basically, you can alter the python script that sends out the emails to suit your needs.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...