Can a header (within the message body) be added to emailed alerts?

Path Finder

I need to be able to put something in the first line of any emails that get sent out by the system that I'm deploying and I have not been able to find an email.header equivalent of the email.footer configuration option within alert_actions.conf.

I have contemplated having to make a customized version of apps/search/bin/ and adding a apps/search/local/commands.conf that points to it, but I want to exhaust any other options first.

My hope is that I can have a system-wide default header which can then be overridden if necessary.

Can it be done without creating a local customization of

0 Karma

Revered Legend

You can customize the default email body to include your custom header message, in alert_actions.conf

[email] = <string>
* Specify a custom email message for scheduled reports.
* Includes the ability to reference attributes from the result,
  saved search, or job

message.alert = <string>
* Specify a custom email message for alerts.
* Includes the ability to reference attributes from result,
  saved search, or job
0 Karma


have you tried to use tokens?

You can add parts of the search results to the mail body:

Do you run an old version? On the new versions of splunk you can easily add text and tokens to the mails via ui:

alt text

Edit: Sorry, if your main problem is that you want it per default in any mail, you may indeed need a custom Or you can try to add an eval with an specific field "header" to any alert and use this in any mail report.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!