Splunk Search

Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

hortonew
Builder

Example search:

| sendemail to=$result.to$ subject=$result.subject$ message=$result.body$

I'm currently pulling the body field from a lookup table, and would like to include some kind of line break in the lookup itself (such as a br tag) to format in the email dynamically. It doesn't seem doable as Splunk or sendemail.py is encoding html characters thus not rendering it as html.

I could use the sendresults app, however currently it doesn't support dynamic fields for subject/body, but it does accept html.

Thoughts?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could replace {msg|h} with {msg} in sendemail.py to allow inclusion of HTML tags in emails - with all the up- and downsides.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could replace {msg|h} with {msg} in sendemail.py to allow inclusion of HTML tags in emails - with all the up- and downsides.

hortonew
Builder

Working nicely - thanks again for the assistance.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Keep in mind, this won't survive an upgrade of Splunk and might technically not be supported.

0 Karma

hortonew
Builder

Noted - enough to get by for a current project.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...