topic Re: Updating text color based on condition using sendemail.py in Alerting

Updating text color based on condition using sendemail.py

mnj1809 — Wed, 17 Apr 2024 15:31:08 GMT

Hello,

I've below dataset from Splunk search.

Name	percentage
A	71%
B	90%
C	44%
D	88%
E	78%

All I need to change the percentage field values color as per below rule in the email alert. My requirement to achieve this by updating the sendemail.py.

95+ green, 80-94 amber, <80 = red

@tscroggins @ITWhisperer @yuanliu @bowesmana

Re: Updating text color based on condition using sendemail.py

yuanliu — Wed, 17 Apr 2024 22:40:01 GMT

Let me clarify: When you say "color", you are talking about converting percentage text to a string representation of color code, not to color the percentage text in E-mail alert. Correct? In other words, you want something like

Name	color	percentage
A	red	71
B	amber	90
C	red	44
D	amber	88
E	red	78

Because while potentially doable (and likely will involve a custom command you need to develop externally), Splunk doesn't provide such a function to color text used in E-mail alerts. If this is the correct requirement, look up documentation for case

I further assume that your "percentage" field doesn't come with a percent sign (%); if you want that % in E-mail, you can always add it after color mapping.

| eval color = case(percentage < 80, "red", percentage < 95, "amber", true(), "green")

Here is a data emulation you can play with and compare with real data

| makeresults format=csv data="Name, percentage A, 71% B, 90% C, 44% D, 88% E, 78%" | eval percentage = replace(percentage, "%", "") ``` data emulation above ```

Hope this helps.

Re: Updating text color based on condition using sendemail.py

mnj1809 — Thu, 18 Apr 2024 05:58:22 GMT

Thanks Yuanliu for your quick reply.

Yes, I need % sign included. In the email body I need to color the data of percentage column like below:

@yuanliu

Re: Updating text color based on condition using sendemail.py

yuanliu — Fri, 19 Apr 2024 06:17:47 GMT

You recognize that this is a Splunk forum where volunteers offer help related to Splunk, right? As I said, Splunk does not "color" search results. (The only coloring function in Splunk is provided in dashboard visualization.) If you want to color text, you will need to develop something external to Splunk. As you suggested, you can possibly achieve this by modifying sendmail.py (not recommended). Alternatively, you can develop a custom command for this. Either way, this is not the right forum.

Re: Updating text color based on condition using sendemail.py

mnj1809 — Fri, 26 Apr 2024 15:10:25 GMT

Thanks @yuanliu for your quick response.

I am totally unaware how to achieve this by creating a custom command.

Re: Updating text color based on condition using sendemail.py

yuanliu — Sun, 28 Apr 2024 00:35:22 GMT

Start with this doc: Write Custom Search Commands.

Re: Updating text color based on condition using sendemail.py

PickleRick — Sun, 28 Apr 2024 07:14:12 GMT

I'd simply say don't go down this path.

sendemail.py is quite well written but a bit confusing for a non-experienced pythoneer. So you'll put a lot of effort for just one use-case. Additionally you'll get stuck with something you'll have to maintain yourself (what if there are updates to the main sendemail.py? What if there are security fixes? Will you backport those?).