topic Re: Splunk Email Alerts Change in Splunk Search

Splunk Email Alerts Change

jmheaton — Tue, 13 May 2014 17:03:43 GMT

So we recently upgraded to v6.1 and through all the changes to the emails, the biggest thing that we miss is that the borders are gone on the chart/table emails. Has anyone found a way to get these back? A lot of our emails have become much harder to read now that they are missing.

Re: Splunk Email Alerts Change

linu1988 — Tue, 13 May 2014 17:23:27 GMT

if you have any other older version of splunk just copy replace the sendemail.py file.

Re: Splunk Email Alerts Change

MuS — Wed, 14 May 2014 07:14:11 GMT

Hi jmheaton,

I would not copy the old sendemail.py from any Splunk < 6.x Version into Splunk v6.x. There were too many changes in the script itself.

If you take a closer look at the sendemail.py script at $SLPUNK_HOME/etc/apps/search/bin/ you can find at line 636 something like this:

        <table cellpadding="0" cellspacing="0" border="0" class="results" style="margin: 20px;">

this is the start of the result table. You can see it has set border="0", I assume if you change it to border="1" you will get back the borders. This is un-tested!

Also keep in mind, that changes in this script can be overwritten by a Splunk update without notice, so be careful.

hope this helps ...

cheers, MuS

Re: Splunk Email Alerts Change

jmheaton — Wed, 14 May 2014 11:40:59 GMT

Their are two lines in the sendemail.py script that i found with that data string. The first one edits the top table with elements such as the Search String / Alert Name. The second however was the one that put the border back on the cells. Thanks much!

Re: Splunk Email Alerts Change

MuS — Wed, 14 May 2014 11:49:17 GMT

you're welcome 😉

Re: Splunk Email Alerts Change

blebit — Thu, 26 Jun 2014 09:53:24 GMT

MuS,

My table has changed colors 😞

Re: Splunk Email Alerts Change

MuS — Thu, 26 Jun 2014 10:05:06 GMT

well, what have you changed?

Re: Splunk Email Alerts Change

blebit — Thu, 26 Jun 2014 10:41:51 GMT

version...upgrade from 5.0.3 to 6.0.4

Re: Splunk Email Alerts Change

blebit — Thu, 26 Jun 2014 10:42:09 GMT

header color is changed

Re: Splunk Email Alerts Change

MuS — Thu, 26 Jun 2014 10:46:45 GMT

look for something like header in the sendemail.py script and see if there is any color set, if yes change it to your needs.

Re: Splunk Email Alerts Change

blebit — Thu, 26 Jun 2014 10:57:46 GMT

w.writerow(header)
# output each result's values
for result in results:
row = [esc(result.get(col,"")) for col in header]
w.writerow(row)
return s.getvalue()

COL is for COLUMN or for COLOR ?

Re: Splunk Email Alerts Change

linu1988 — Fri, 27 Jun 2014 03:23:07 GMT

def htmlTableTemplate

`<th style="text-align: left;

add color: blue/red.. for splunk 6`