Alerting

Alerts search query

Motivator

Hey,

When I receive a Splunk alert, the email contains the Splunk search query which was executed in order to trigger the alert.

How do I stop the search query from being included in the body of the email alerts that get sent out?

Thanks in advance for your help.

0 Karma
1 Solution

Motivator

A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.

View solution in original post

0 Karma

Motivator

A suitable, but possibly inefficient way to get around this would be to use search macros. The query that triggers the alert can be stored in a search macro. This would mean that when the alert is sent, the email will only contain the name of the search macro. This means that the search query is hidden from the email recipient.

View solution in original post

0 Karma

Motivator

There should be a include results check box under alerts. AFAIK if you don't tick that option you won't get the results in that alert.

0 Karma

Motivator

Unticking that box would mean that the results are not returned and the results should be returned. The search which produces those results is included in the email. This is not wanted. At present, I believe that a workaround might be to convert the search to a macro but I haven't tested this yet. If this works, then a simple macro name will be returned in the email and not the entire search query.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!