Alerting

Generating Alert, ability to exclude search term in email

rdownie
Communicator

Is there a way to exclude the actual search string in the email generated out of an alert. I understand you can exclude results but is there a way to exclude the actual search string from the email There are times when there can be sensitive information in the actual string that you do not want to include in the alert email.

Thanks,

Bob

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

--
Jesse Trucks
Minister of Magic

View solution in original post

supersleepwalke
Communicator

Two ways:

First way is to save the search, and give it a name (e.g. "My saved search"). DO NOT schedule this search. Then create a different scheduled search and use the savedsearch directive:

| savedsearch "My saved search"

Then the alert e-mail will only contain the above string, not the original query which might be sensitive.

Another way, less work, but also less assured. Splunk's alert e-mails only include the up to the first carriage return in your search. So, you can put some innocuous search stuff at the beginng. For instance:

index=*
index=sensitive key=value
| stats count by sensitivefield

When you get the alert e-mail, only the first line ("index=*") will be included.

rdownie
Communicator

This works.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

--
Jesse Trucks
Minister of Magic

rdownie
Communicator

Yeah that is what I figured. I was hoping it was configurable.
Thanks,
-Bob

0 Karma

rdownie
Communicator

I am guessing having it call a script to generate a custom email is the only way to do this?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...