Reporting

What the SPLUNK?

jon_yarbrough
New Member

hi everyone, i'm new to Splunk and i've read through the tons of forums and i can't find the solution to my problem. what i'm trying to do is to change the headers and the information that is shown when an email alert is sent to me with the errors that i determined i would like to view. i have no idea where i can find the headers or where/how to create a custom search result. do i need to create a script or something and if i do, where does the script go? does it go in the scripts folder on the SPLUNK server or on the web base UI?

Tags (1)
0 Karma

gekoner
Communicator

In the WebGUI go to Manager --> Searches and Reports. Either create a new Saved Search (I wasn't sure if you had already created one or not) or edit the search you want change the email notification for.
Under the Schedule and alert section, mark the check-box labeled Schedule this search
You should then see all of the fields available for you to edit.
Under Alert actions, find Send email, and mark the check-box that says "Enable"

You can then modify the Email subject, Email address(es), and what to include in the results of your email.
For more options and functionality see this post -http://splunk-base.splunk.com/answers/621/email-alert-subject

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...