is there any way i can configure a saved search that will send me the results, but rather than attaching the results as a CSV attachment, put the raw log with the search results inline inside the email?
id like to look at the emailed alerts via email on my blackberry without opening/downloading csv files.
If you don't want inline results on a system-wide basis, you can configure results to be included inline by adding the following setting to a particular saved search (in saved searches.conf):
action.email.inline = 1
Obviously this requires access to the filesystem. I've filed an ER to make this a configurable option from the UI.
If you don't want inline results on a system-wide basis, you can configure results to be included inline by adding the following setting to a particular saved search (in saved searches.conf):
action.email.inline = 1
Obviously this requires access to the filesystem. I've filed an ER to make this a configurable option from the UI.
There is an "inline" parameter in alert_actions.conf:
inline = <true | false>
* Specify whether the search results are contained in the body of the alert email.
* Defaults to false.
See more detail here:
http://www.splunk.com/base/Documentation/latest/Admin/Alertactionsconf