topic Re: Alert Trigger Send Email Default message -> can I change it ? in Other Usage

Alert Trigger Send Email Default message -> can I change it ?

SewingMachine77 — Mon, 29 Apr 2024 21:26:21 GMT

Can I change the default message in the Alert Trigger "Send Email" ? I have been looking around and cant find anything where I could change this. My goal is to create a template message so we can stream light our alert messages. Any help would be great !

Re: Alert Trigger Send Email Default message -> can I change it ?

tej57 — Tue, 30 Apr 2024 08:01:09 GMT

Hello @SewingMachine77,

I do not think there is a possibility to create templates and use them in the alerts. However, you can definitely customize the message for the saved search. Additionally, you can also use the search job tokens and use them in the message.

Refer to the following document for assistance with search job tokens: https://docs.splunk.com/Documentation/Splunk/9.2.1/Alert/EmailNotificationTokens

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.

Re: Alert Trigger Send Email Default message -> can I change it ?

SewingMachine77 — Tue, 30 Apr 2024 15:52:51 GMT

Really what I want is to replace that default text to something like this ( Below ) Instead of the Message in the picture above.

Example:

Alert Description:

Alert Steps:

Look at it
Do Something

Alert Escalation:

Alert Updating:

Re: Alert Trigger Send Email Default message -> can I change it ?

burwell — Wed, 01 May 2024 01:01:24 GMT

Hi in addition to using tokens as was suggested you can template the body of the message by configuring alert_actions.conf

For example you could have an alert_actions.conf (don't update the etc/system/default one) and add

[email] message.alert = Please fill this report in as follows\ Step 1\ Step 2\ \ And finally\ Step 3

I use the \ because you want the message.alert value to span multiple lines. That should get you something like the attached screenshot.

More details here

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf