Alerting

Can email support two formats?

hjwang
Contributor

splunk now supports email format including txt,html,raw,csv. now we wanna send email by html format and sms by raw format in the same saved-research. Can splunk support this? we wrote sms function in sendemail.py to trigger email and sms alert at the same time.Thanks

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

email is sent just by sending the search results to the sendemail.py script. You can simply make a copy and modify this script to create a new custom search command and pipe your results to that new script instead. You could change the default one, but that is actually a bit more involved if you want to avoid your changes being overwritten on upgrades.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

email is sent just by sending the search results to the sendemail.py script. You can simply make a copy and modify this script to create a new custom search command and pipe your results to that new script instead. You could change the default one, but that is actually a bit more involved if you want to avoid your changes being overwritten on upgrades.

Lowell
Super Champion

Anything in "local" should not be overwritten, you are correct; but you run the risk of anything in your "bin" folder being overwritten during an upgrade. Making a new app is fairly simple and I would recommend packaging all of that up within your own app.

0 Karma

hjwang
Contributor

That's ok. if i put commands.conf in $splunk_home/etc/apps/search/local directory, theoretically, it should be avoided changes being overwritten on updates, right?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...