<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Remove query and table header from Emails in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80969#M1132</link>
    <description>&lt;P&gt;If I were to do something like the above, can I still have it trigger only if there are results? I have started using CASE recently, but that doesn't seem like an appropriate method here...&lt;/P&gt;</description>
    <pubDate>Fri, 11 Oct 2013 14:56:52 GMT</pubDate>
    <dc:creator>kknopp</dc:creator>
    <dc:date>2013-10-11T14:56:52Z</dc:date>
    <item>
      <title>Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80965#M1128</link>
      <description>&lt;P&gt;Is there any way to remove the query and table header information from alerts? I am aware of a previous question on the topic however there has not been a solution since that posting. Basically some of my alerts will be sent to smartphones and I would like to remove as much content as possible and only provide meaningful fields.&lt;/P&gt;</description>
      <pubDate>Sat, 30 Oct 2010 04:05:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80965#M1128</guid>
      <dc:creator>Andruep</dc:creator>
      <dc:date>2010-10-30T04:05:14Z</dc:date>
    </item>
    <item>
      <title>Re: Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80966#M1129</link>
      <description>&lt;P&gt;See also this &lt;A href="http://answers.splunk.com/questions/5862/remove-query-from-emails" rel="nofollow"&gt;earlier thread&lt;/A&gt;. 
A couple of possibilities:&lt;/P&gt;

&lt;P&gt;&lt;LI&gt;Run a scheduled search, but instead of using the normal alert mechanism, call the &lt;CODE&gt;sendemail&lt;/CODE&gt; command directly, e.g., &lt;CODE&gt;|sendemail to=user@domain.com subject="Something" sendresults=true&lt;/CODE&gt;&lt;/LI&gt;&lt;/P&gt;

&lt;P&gt;&lt;LI&gt;Roll your own version of the emailer script (see &lt;A href="http://answers.splunk.com/questions/6423/how-to-change-default-alert-smtp-port" rel="nofollow"&gt;thread 6423&lt;/A&gt; for more detail).&lt;/LI&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 30 Oct 2010 04:41:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80966#M1129</guid>
      <dc:creator>southeringtonp</dc:creator>
      <dc:date>2010-10-30T04:41:35Z</dc:date>
    </item>
    <item>
      <title>Re: Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80967#M1130</link>
      <description>&lt;P&gt;Thanks for the suggestion, however, I received the error below after adding the sendemail string to the end of my search.&lt;/P&gt;

&lt;P&gt;[Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: &lt;A href="mailto:abc@abc.org"&gt;abc@abc.org&lt;/A&gt;. &lt;/P&gt;

&lt;P&gt;&lt;A href="mailto:abc@abc.org"&gt;abc@abc.org&lt;/A&gt; is a filler email address. My actual email address was used.&lt;/P&gt;</description>
      <pubDate>Wed, 03 Nov 2010 03:34:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80967#M1130</guid>
      <dc:creator>Andruep</dc:creator>
      <dc:date>2010-11-03T03:34:50Z</dc:date>
    </item>
    <item>
      <title>Re: Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80968#M1131</link>
      <description>&lt;P&gt;By default, it will use localhost as the mail server. If you want to use a remote server, you can add another parameter &lt;CODE&gt;server=mail.yourdomain.com&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 04 Nov 2010 00:37:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80968#M1131</guid>
      <dc:creator>southeringtonp</dc:creator>
      <dc:date>2010-11-04T00:37:44Z</dc:date>
    </item>
    <item>
      <title>Re: Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80969#M1132</link>
      <description>&lt;P&gt;If I were to do something like the above, can I still have it trigger only if there are results? I have started using CASE recently, but that doesn't seem like an appropriate method here...&lt;/P&gt;</description>
      <pubDate>Fri, 11 Oct 2013 14:56:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80969#M1132</guid>
      <dc:creator>kknopp</dc:creator>
      <dc:date>2013-10-11T14:56:52Z</dc:date>
    </item>
    <item>
      <title>Re: Remove query and table header from Emails</title>
      <link>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80970#M1133</link>
      <description>&lt;P&gt;Really, seems like direct sendemail command disables all the alerting conditions, isn't it?&lt;/P&gt;</description>
      <pubDate>Fri, 24 Jan 2014 07:55:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Remove-query-and-table-header-from-Emails/m-p/80970#M1133</guid>
      <dc:creator>0range</dc:creator>
      <dc:date>2014-01-24T07:55:40Z</dc:date>
    </item>
  </channel>
</rss>

