How do i customize scheduled search alert emails

[Chris_R_]

I would like to customize the scheduled alert email contents beyond what is included in the default email look and feel, how do i do so?

[gdavid]

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script.

\Splunk\etc\apps\search\local\commands.conf
[sendemail]
filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py
streaming = false
run_in_preview = false

[Chris_R_ · Accepted solution]

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false