topic Remove query from Emails in Reporting

Remove query from Emails

Hazel — Sat, 21 Aug 2010 00:11:24 GMT

Hello,

Is there a way to remove the splunk query from the email that is sent out? A lot of our emails go out to users, so we just want them to see the table of results and don't want them to get confused with the query that we ran.

I see an option to include the results. Is there no option to exclude the splunk query?

Thanks Hazel

Re: Remove query from Emails

Stephen_Sorkin — Sat, 21 Aug 2010 00:24:01 GMT

Unfortunately there's no well supported way of doing this, but it's a good enhancement request to forward on to Customer Support.

If you are feeling daring, you can modify $SPLUNK_HOME/etc/apps/search/bin/sendemail.py which renders emails. Note that any modifications will be overwritten on upgrade.

Re: Remove query from Emails

southeringtonp — Sat, 18 Sep 2010 04:22:03 GMT

If you do modify the script, DON'T modify it in-place. Instead, make a copy and override the sendemail command in the search app. There has been some discussion along these lines in some older threads, including this one -- http://answers.splunk.com/questions/6423/how-to-change-default-alert-smtp-port

Re: Remove query from Emails

jcrane — Thu, 21 Feb 2013 21:17:11 GMT

I have read the other posts for this as well as this one and the answers are not good ones. This should be an option in the UI.

Re: Remove query from Emails

DerekB — Thu, 22 May 2014 23:23:52 GMT

Starting in Splunk 6.1, this ability is built into the product. Edit your search and look under the "Click to edit email action" link in the "Alert Actions" section. It's a simple check box you can uncheck. It's in the picture in step 4.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Setupalertactions