Reporting

New Line Break Character with Sendemail message (Splunk 6.1.4)

tony_14
New Member

So I'm trying to pipe a search query to sendemail to email specific messages based on search results and format the message/body of that email to use line breaks and paragraphs rather than one long message. (Splunk 6.1.4)

search query | sendemail to=email_address from=from_email subject=alert_subject message="Alert first line \r\n second line with $result.Field$ \r\n third line"

I've tried:
\n
\r\n
\r\n\r\n
\n\r
[\r\n]
[\n\r]

No luck. And I know it's not outlook messing up the message because the default footer is correctly displayed with proper line breaks. The default footer should be: "If you believe you've received this email in error, please see your Splunk administrator.\r\n\r\nsplunk > the engine for machine data." according to the documentation but \r\n doesn't seem to work for me.

I can format the message correctly using the built in alert tool but I can't customize the FROM address using the alert app, so trying to get sendemail to work.

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Sendemail

0 Karma

bjoernjensen
Contributor

Hi,

you might want to try Shift + Enter to get a newline within the search query.

Moreover: If you would like to have your result embedded in a certain text, you should form your search in a way everything fits in one event and one field (😞
... | eval raw="This is my first value: " + file + ", and<<*Shift+Enter
>>
my second value: " + 'file' + "." | table raw | rename raw as _raw | sendemail format=raw sendresults=true ... message="welcome message"

To archive this (*), you may have to use commands like transpose, foreach, xyseries, untable

Cheerz

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...