topic Remove Search query from the email Alert in Alerting

Remove Search query from the email Alert

sunilsk1 — Mon, 26 Aug 2013 06:58:56 GMT

I have scheduled a email alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

Re: Remove Search query from the email Alert

lcrielaa — Mon, 26 Aug 2013 09:36:24 GMT

A quick search turned up the following question that someone asked earlier:

http://answers.splunk.com/answers/31388/email-report-format

basically, you can alter the python script that sends out the emails to suit your needs.

Re: Remove Search query from the email Alert

sunilsk1 — Mon, 26 Aug 2013 17:38:55 GMT

Instead of making any changes to the python script. you can use the following if you need an email everytime the search is executed.

You can disable the Email alert(uncheck the checkbox for Email) and add the following to your Splunk search query -
|sendemail to="@mailid.com" format=html subject=myresults server=mail.splunk.com sendresults=true

if it throws any error then remove the server info from the search : |sendemail to="@mailid.com" format=html subject=myresults sendresults=true

If the alert condition is met then the

Re: Remove Search query from the email Alert

DerekB — Thu, 22 May 2014 23:22:46 GMT

Starting in Splunk 6.1, this ability is built into the product. Edit your search and look under the "Click to edit email action" link in the "Alert Actions" section. It's a simple check box you can uncheck. It's in the picture in step 4.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Setupalertactions

Re: Remove Search query from the email Alert

dyork — Fri, 21 Oct 2016 05:15:33 GMT

Worked a treat!
Thanks mate