Whenever splunk sends an email after a triggerd alert or scheduled report , an error occurs in function 'realize(...)', which is from sendemail.py .
As a result, the function sets email's subject and message back to default value forcefully.
Besides, each mail contains the following note:
"The dynamic substitution of the email subject failed because of failed token substitution."
Mail text customization becomes impossible due to this error.
p.s. Nothing about this error is recorded in splunkd.log. I dont find any error info.
Hope someone can help me out.
Thanks a lot.
Here is the related code from function 'realize(..)':
try:
for key, value in stringsForPost.iteritems():
if len(value.strip()) == 0:
logger.warning('Token substitution may fail due to key:%s contains only whitespaces' % key)
postargs['name'] = value
headers, body = simpleRequest(
realizeURI,
method='POST',
postargs=postargs,
sessionKey=sessionKey
)
body = json.loads(body)
ssContent[key] = body['entry'][0]['content']['eai:data']
except Exception as e:
logger.error(e)
# SPL-96721: email subject didn't get replaced, reset it to ssname
if ssContent.get('action.email.subject') == stringsForPost.get('action.email.subject'):
ssContent['action.email.subject'] = "Splunk Alert:"+argvals['ssname']
ssContent['action.email.message'] = ssContent['action.email.message'] + "\n\nNOTE: The dynamic substitution of the email subject failed because of failed token substitution. A generic subject has been used instead. Please check splunkd.log for additional details."
... View more