Can a header (within the message body) be added to emailed alerts?

[chris_barrett]

I need to be able to put something in the first line of any emails that get sent out by the system that I'm deploying and I have not been able to find an email.header equivalent of the email.footer configuration option within alert_actions.conf.

I have contemplated having to make a customized version of apps/search/bin/sendemail.py and adding a apps/search/local/commands.conf that points to it, but I want to exhaust any other options first.

My hope is that I can have a system-wide default header which can then be overridden if necessary.

Can it be done without creating a local customization of sendemail.py?

[somesoni2]

You can customize the default email body to include your custom header message, in alert_actions.conf

[email]
message.report = <string>
* Specify a custom email message for scheduled reports.
* Includes the ability to reference attributes from the result,
  saved search, or job

message.alert = <string>
* Specify a custom email message for alerts.
* Includes the ability to reference attributes from result,
  saved search, or job

[tom_frotscher]

Hi,

have you tried to use tokens?

You can add parts of the search results to the mail body:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Report/Schedulereports#Use_tokens_in_scheduled_rep...

Do you run an old version? On the new versions of splunk you can easily add text and tokens to the mails via ui:

Edit: Sorry, if your main problem is that you want it per default in any mail, you may indeed need a custom sendmail.py. Or you can try to add an eval with an specific field "header" to any alert and use this in any mail report.