Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Alerts search query
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey,
When I receive a Splunk alert, the email contains the Splunk search query which was executed in order to trigger the alert.
How do I stop the search query from being included in the body of the email alerts that get sent out?
Thanks in advance for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There should be a include results check box under alerts. AFAIK if you don't tick that option you won't get the results in that alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unticking that box would mean that the results are not returned and the results should be returned. The search which produces those results is included in the email. This is not wanted. At present, I believe that a workaround might be to convert the search to a macro but I haven't tested this yet. If this works, then a simple macro name will be returned in the email and not the entire search query.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
