Can a header (within the message body) be added to emailed alerts?

Path Finder

I need to be able to put something in the first line of any emails that get sent out by the system that I'm deploying and I have not been able to find an email.header equivalent of the email.footer configuration option within alert_actions.conf.

I have contemplated having to make a customized version of apps/search/bin/ and adding a apps/search/local/commands.conf that points to it, but I want to exhaust any other options first.

My hope is that I can have a system-wide default header which can then be overridden if necessary.

Can it be done without creating a local customization of

0 Karma

Revered Legend

You can customize the default email body to include your custom header message, in alert_actions.conf

[email] = <string>
* Specify a custom email message for scheduled reports.
* Includes the ability to reference attributes from the result,
  saved search, or job

message.alert = <string>
* Specify a custom email message for alerts.
* Includes the ability to reference attributes from result,
  saved search, or job
0 Karma



have you tried to use tokens?

You can add parts of the search results to the mail body:

Do you run an old version? On the new versions of splunk you can easily add text and tokens to the mails via ui:

alt text

Edit: Sorry, if your main problem is that you want it per default in any mail, you may indeed need a custom Or you can try to add an eval with an specific field "header" to any alert and use this in any mail report.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!