Email Alert Subject

[kbecker]

Is it possible to add data from a search to the subject line of an email alert? Currently the subject defaults to the name of the saved search, I would also like to append the host name to the subject that generated the alert. It looks like this would be configured in saved_searches.conf by using the action.email.subject parameter, I just do not know if it is possible to pass search results to it or how this would be done?

Thanks in advance for any help...

[Jason]

As of 4.1.4, you can edit the subject line via the Web Manager interface at <splunk web address>/en-US/manager/search/configs/conf-alert_actions/email?action=edit

[parallaxed]

Echoing the previous answer, writing a script of your own to craft the email sounds like a better solution. The arguments that are given to scripted alerts are listed in the docs:

http://www.splunk.com/base/Documentation/3.1.1/Admin/SetUpAlerts#Script_options

[jrodman · Accepted solution]

You can see what the script will do with the resulting string by popping open sendemail.py. I don't think the string has any variable expansion etc applied to it before passing the string along.

If you run your searches in your own app, it could supply its own (modfied) sendemail searchscript to override the behavior. There's some downsides there (field extractions, tags may not be available in that app). Alternatively, you could just use a different alert script instead of the built-in emailing facility. Either way you get control over the behavior.

I'm not sure what a more flexible email control interface looks like. Ideally, I think you'd want it to tie into the the search language flexibility.

There's definitely some ER here of some kind. If the question is something like 'which of my 80 splunk instances is responsible for this search?' then we should maybe wire in some defaults.