Alerting

Can email support two formats?

Contributor

splunk now supports email format including txt,html,raw,csv. now we wanna send email by html format and sms by raw format in the same saved-research. Can splunk support this? we wrote sms function in sendemail.py to trigger email and sms alert at the same time.Thanks

Tags (3)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

email is sent just by sending the search results to the sendemail.py script. You can simply make a copy and modify this script to create a new custom search command and pipe your results to that new script instead. You could change the default one, but that is actually a bit more involved if you want to avoid your changes being overwritten on upgrades.

View solution in original post

Splunk Employee
Splunk Employee

email is sent just by sending the search results to the sendemail.py script. You can simply make a copy and modify this script to create a new custom search command and pipe your results to that new script instead. You could change the default one, but that is actually a bit more involved if you want to avoid your changes being overwritten on upgrades.

View solution in original post

Super Champion

Anything in "local" should not be overwritten, you are correct; but you run the risk of anything in your "bin" folder being overwritten during an upgrade. Making a new app is fairly simple and I would recommend packaging all of that up within your own app.

0 Karma

Contributor

That's ok. if i put commands.conf in $splunk_home/etc/apps/search/local directory, theoretically, it should be avoided changes being overwritten on updates, right?

0 Karma