How to use HTML code in email alerts to format the message body?

[ibondarets]

Hi!

I'm trying to create an email alert and format the message body in a particular way, because inline table/raw/csv doesn't suit my needs.
I'm selecting "HTML & Plain text" as action type and try to use HTML tags, but they're all ignored and treated by Splunk as text.

How can I do that?

[eregon]

Action "Send email" does not allow to use your own HTML in the message. If this action's options are too limiting, you need to go for Custom alert actions, see https://docs.splunk.com/Documentation/Splunk/7.2.1/AdvancedDev/ModAlertsIntro .

For sake of completeness, "Run script" action could also help (ie. you could copy default sendmail.py and alter it to your needs, or write your own script from scratch), however this method has been deprecated in favor of Custom alert actions.

[mprreddy51]

Hi,

Set the properties in alert_actions.conf file

[mclane1]

I downvoted this post because alert_action.conf is a conf for all alerts (not just for one alert). in addition, the file is in root access on a unix server and in an enterprise solution, we can not modify it.

[ibondarets]

Hi!
Thank you for reply.
What properties?

I tried to add:

content_type = html

to /opt/splunk/etc/system/local/alert_actions.conf

No result.

The only thing that helps is to change {msg|h} to {msg} in
/opt/splunk/etc/apps/search/bin/sendemail.py
but it's a dirty hack that wil break after every splunk update.

I need a supported way to do it...

[Honey0308]

Hi @ibondarets,

I was having a similar use case, to add HTML tags to Alert Mail.
I tried everything in the alerts_action.conf but was not able to achieve the results. Then I tried your suggestion of modifying the sendemail.py. It works like a charm. Thanks a Lot.

I may be an amateur, and therefore cannot deduce the logic behind this. It would be of great help if you can provide a brief explanation of the changes made in the python file. Does it have any negative affectc or can hamper any other functionality? Did you came out with an alternative to this solution?

I know this is an old post, and I have posed a lot of questions. But Thanks in Advance. I'll be waiting for your response patiently.

Thanks Again. 🙂