topic Re: Generating Alert, ability to exclude search term in email in Alerting

Generating Alert, ability to exclude search term in email

rdownie — Wed, 06 Nov 2013 15:28:56 GMT

Is there a way to exclude the actual search string in the email generated out of an alert. I understand you can exclude results but is there a way to exclude the actual search string from the email There are times when there can be sensitive information in the actual string that you do not want to include in the alert email.

Thanks,

Bob

Re: Generating Alert, ability to exclude search term in email

rdownie — Wed, 06 Nov 2013 15:44:21 GMT

I am guessing having it call a script to generate a custom email is the only way to do this?

Re: Generating Alert, ability to exclude search term in email

jtrucks — Thu, 07 Nov 2013 19:41:47 GMT

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

Re: Generating Alert, ability to exclude search term in email

rdownie — Tue, 12 Nov 2013 13:18:37 GMT

Yeah that is what I figured. I was hoping it was configurable.
Thanks,
-Bob

Re: Generating Alert, ability to exclude search term in email

supersleepwalke — Thu, 14 Nov 2013 17:36:58 GMT

Two ways:

First way is to save the search, and give it a name (e.g. "My saved search"). DO NOT schedule this search. Then create a different scheduled search and use the savedsearch directive:

| savedsearch "My saved search"

Then the alert e-mail will only contain the above string, not the original query which might be sensitive.

Another way, less work, but also less assured. Splunk's alert e-mails only include the up to the first carriage return in your search. So, you can put some innocuous search stuff at the beginng. For instance:

index=*
index=sensitive key=value
| stats count by sensitivefield

When you get the alert e-mail, only the first line ("index=*") will be included.

Re: Generating Alert, ability to exclude search term in email

rdownie — Thu, 14 Nov 2013 17:39:31 GMT

This works.