topic Re: Can email support two formats? in Alerting

Can email support two formats?

hjwang — Wed, 01 Dec 2010 11:26:18 GMT

splunk now supports email format including txt,html,raw,csv. now we wanna send email by html format and sms by raw format in the same saved-research. Can splunk support this? we wrote sms function in sendemail.py to trigger email and sms alert at the same time.Thanks

Re: Can email support two formats?

gkanapathy — Wed, 01 Dec 2010 13:05:05 GMT

email is sent just by sending the search results to the sendemail.py script. You can simply make a copy and modify this script to create a new custom search command and pipe your results to that new script instead. You could change the default one, but that is actually a bit more involved if you want to avoid your changes being overwritten on upgrades.

Re: Can email support two formats?

hjwang — Wed, 01 Dec 2010 14:01:47 GMT

That's ok. if i put commands.conf in $splunk_home/etc/apps/search/local directory, theoretically, it should be avoided changes being overwritten on updates, right?

Re: Can email support two formats?

Lowell — Wed, 01 Dec 2010 22:34:02 GMT

Anything in "local" should not be overwritten, you are correct; but you run the risk of anything in your "bin" folder being overwritten during an upgrade. Making a new app is fairly simple and I would recommend packaging all of that up within your own app.