Alerting

Alerts search query

Ant1D
Motivator

Hey,

When I receive a Splunk alert, the email contains the Splunk search query which was executed in order to trigger the alert.

How do I stop the search query from being included in the body of the email alerts that get sent out?

Thanks in advance for your help.

0 Karma
1 Solution

Ant1D
Motivator

A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.

View solution in original post

0 Karma

Ant1D
Motivator

A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.

0 Karma

theouhuios
Motivator

There should be a include results check box under alerts. AFAIK if you don't tick that option you won't get the results in that alert.

0 Karma

Ant1D
Motivator

Unticking that box would mean that the results are not returned and the results should be returned. The search which produces those results is included in the email. This is not wanted. At present, I believe that a workaround might be to convert the search to a macro but I haven't tested this yet. If this works, then a simple macro name will be returned in the email and not the entire search query.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...