How to getrid of the header info in a report

xvxt006 — Fri, 17 Jan 2014 18:12:08 GMT

Hi,

we have scheduled a report and getting an email using Splunk. But we don't want to display the header info but we want just the actual data. For example below info we don't want to display. Is there an easy way not to display this info while getting an email.

Name: 'OrdersRevenueByHour'
Query Terms: 'OrdersRevenue'
Link to results: http://ap506:8000/app/search/@go?sid=scheduler__xv__search__RMD5051b14c56cfffbdc_at_1389981720_195885
Alert was triggered because of: 'Saved Search [OrdersRevenueByHour]: number of events(23)'

Re: How to getrid of the header info in a report

linu1988 — Fri, 17 Jan 2014 18:42:28 GMT

Hello,
If you don't want the extra details or want to customize the output email you need to modify the default sendmail.py file fro your app. Please take a backup before do ant changes.

Go to [Splunk\etc\apps\[search\app_name]\bin\]the content carefully remove which ever part you don't require:

intro += "Saved search results.\n\n"

    if settings != None:
        user  = settings.get("user", None)
        if user:
            intro += "User: \'" + escape(user, plainText) + "\'\n"

    if ssName:
        intro += "Name: \'" + escape(ssName, plainText) + "\'\n"

    query = getarg(argvals, "ssquery", None)
    if query:
        intro += "Query Terms: \'" + escape(query, plainText) + "\'\n"

    ssLink = getarg(argvals, "sslink", None)
    if ssLink and not plainText:
        ssLink = "<a href=\"" + ssLink + "\">" + ssLink + "</a>"

    if ssLink:
        intro += "Link to results: " + ssLink + "\n";

    ssSummary = getarg(argvals, "sssummary", None)
    if ssSummary:
        intro += "Alert was triggered because of: \'" + escape(ssSummary, plainText) + "\'\n"

Thanks

topic Re: How to getrid of the header info in a report in Reporting

How to getrid of the header info in a report

Re: How to getrid of the header info in a report