https://community.splunk.com/t5/Alerting/Splunk-alert-mails-and-its-content/m-p/452809#M11713 <P>Hello @Deepz2612,</P> <P>I use the following Splunk search for listing all triggered email alerts:</P> <PRE><CODE>index=_audit source=audittrail sourcetype=audittrail alert_actions=email | eval _time=trigger_time | rename ss_name as Alert severity as Severity triggered_alerts as Count | eval Severity=case(Severity==1,"Info",Severity==2,"Low",Severity==3,"Medium",Severity==4,"High",Severity==5,"Critical") | table _time,Alert,Severity,Count | sort -_time </CODE></PRE> <P>About the mail body content: I don't think that Splunk logs the mail body. I could not find it anywhere in the internal indexes. I would suggest that you send your alerts to an additional email address for logging purposes. (You can specify multiple email addresses separated by commas in the alert's settings.)</P> Fri, 22 Mar 2019 08:54:28 GMT whrg 2019-03-22T08:54:28Z https://community.splunk.com/t5/Alerting/Splunk-alert-mails-and-its-content/m-p/452808#M11712 <P>Hi,</P> <P>Is there a way to get the list of Splunk alert mails being sent and the mail body content pls.</P> Fri, 22 Mar 2019 08:16:06 GMT https://community.splunk.com/t5/Alerting/Splunk-alert-mails-and-its-content/m-p/452808#M11712 Deepz2612 2019-03-22T08:16:06Z https://community.splunk.com/t5/Alerting/Splunk-alert-mails-and-its-content/m-p/452809#M11713 <P>Hello @Deepz2612,</P> <P>I use the following Splunk search for listing all triggered email alerts:</P> <PRE><CODE>index=_audit source=audittrail sourcetype=audittrail alert_actions=email | eval _time=trigger_time | rename ss_name as Alert severity as Severity triggered_alerts as Count | eval Severity=case(Severity==1,"Info",Severity==2,"Low",Severity==3,"Medium",Severity==4,"High",Severity==5,"Critical") | table _time,Alert,Severity,Count | sort -_time </CODE></PRE> <P>About the mail body content: I don't think that Splunk logs the mail body. I could not find it anywhere in the internal indexes. I would suggest that you send your alerts to an additional email address for logging purposes. (You can specify multiple email addresses separated by commas in the alert's settings.)</P> Fri, 22 Mar 2019 08:54:28 GMT https://community.splunk.com/t5/Alerting/Splunk-alert-mails-and-its-content/m-p/452809#M11713 whrg 2019-03-22T08:54:28Z