- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can a header (within the message body) be added to emailed alerts?
I need to be able to put something in the first line of any emails that get sent out by the system that I'm deploying and I have not been able to find an email.header
equivalent of the email.footer
configuration option within alert_actions.conf.
I have contemplated having to make a customized version of apps/search/bin/sendemail.py
and adding a apps/search/local/commands.conf
that points to it, but I want to exhaust any other options first.
My hope is that I can have a system-wide default header which can then be overridden if necessary.
Can it be done without creating a local customization of sendemail.py?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can customize the default email body to include your custom header message, in alert_actions.conf
[email]
message.report = <string>
* Specify a custom email message for scheduled reports.
* Includes the ability to reference attributes from the result,
saved search, or job
message.alert = <string>
* Specify a custom email message for alerts.
* Includes the ability to reference attributes from result,
saved search, or job
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
have you tried to use tokens?
You can add parts of the search results to the mail body:
Do you run an old version? On the new versions of splunk you can easily add text and tokens to the mails via ui:
Edit: Sorry, if your main problem is that you want it per default in any mail, you may indeed need a custom sendmail.py. Or you can try to add an eval with an specific field "header" to any alert and use this in any mail report.