topic Re: Sendemail command in Reporting

Sendemail command

andrey2007 — Thu, 06 Mar 2014 10:29:45 GMT

I use sendemail command in scheduled search which runs every 5 minutes .
search looks like
index=myindex user=* | table user host source| sendemail.py to="me@company.com" subject="SPLUNK alert" sendresults=true server=1.1.1.1

Even there are no results i receive message with text "No results".

Is it possible to exclude such messages?

Re: Sendemail command

martin_mueller — Thu, 06 Mar 2014 10:37:07 GMT

You could change your search to a regular alert and remove the sendemail command from the search. Then you get features such as filtering for number of results > 0 through the alert configuration.

Re: Sendemail command

andrey2007 — Thu, 06 Mar 2014 10:47:16 GMT

Sure but when I make it i receive on email table with my results and empty graph above it. I do not know where does this graph originates from? So I tried sendemail command.

Re: Sendemail command

martin_mueller — Thu, 06 Mar 2014 10:52:30 GMT

What do you mean by empty graph above it?

Re: Sendemail command

andrey2007 — Thu, 06 Mar 2014 11:13:16 GMT

something like result of chart command execution but it is empty and has legend with specified field names which I used in my search (user host source).

Re: Sendemail command

martin_mueller — Thu, 06 Mar 2014 20:15:19 GMT

Is that delivered as a PDF attachment?

Re: Sendemail command

andrey2007 — Fri, 07 Mar 2014 09:38:08 GMT

yes, it is pdf attachment. My main goal is to get only table without message headers(alert name, link to results and etc.)

Re: Sendemail command

martin_mueller — Fri, 07 Mar 2014 10:14:11 GMT

Turn off PDF delivery then, you won't get an empty graph anymore.

Re: Sendemail command

andrey2007 — Fri, 07 Mar 2014 12:02:38 GMT

But i will get alert name, link to results and etc. even if i turn off pdf delivery and include inline results(

Re: Sendemail command

martin_mueller — Fri, 07 Mar 2014 12:34:03 GMT

Yup, those are hardcoded into the sendemail command. You can copy that python file and add your own command to splunk, say "mysendemail", and use that in alert_actions.conf. In there you can change how you'd like your mails to look.

Re: Sendemail command

andrey2007 — Fri, 07 Mar 2014 12:55:48 GMT

Yes I had to choose this way and now i am modifying sendemail.py in search app.