topic Re: Structure modification of message alert in Alerting

Structure modification of message alert

evang_26 — Tue, 17 Dec 2013 20:05:08 GMT

Hello Splunk users,

I am eager to know if there is any way to modify the message generated by alerts in terms of structure in order to make it a little bit shiny. Whenever I receive an email alert, is kind of just letters and only a simple html-like table. I want to modify the colors, table and so on.
Could you please me tell where to look to, so as to modify the code there?

Any suggestions are greatly appreciated!
Evang

Re: Structure modification of message alert

tararso — Tue, 17 Dec 2013 21:41:42 GMT

You can modify sendemail.py located under $SPLUN_KHOME\etc\apps\search\bin.

Re: Structure modification of message alert

evang_26 — Tue, 17 Dec 2013 21:53:40 GMT

Hi Tararso,

Thanks for your reply. I am new to Splunk, would you mind guide me through the $SPLUN_KHOMEetcappssearchbin?
Is it somewhere on the manager?

Thanks,
Evang

Re: Structure modification of message alert

tararso — Tue, 17 Dec 2013 21:57:14 GMT

not in the manager. You need to open sendemail.py from splunk installed folder which is located under $SPLUN_KHOME\etc\apps\search\bin

Re: Structure modification of message alert

evang_26 — Wed, 18 Dec 2013 12:04:19 GMT

Thanks again Tararso,

I'll try to make it done and let you know.

Regards,
Evang

Re: Structure modification of message alert

MuS — Wed, 18 Dec 2013 12:31:45 GMT

Just a reminder: sendemail.py could be overwritten by any Splunk update. So keep that in mind if you change it 😉