Generating Alert, ability to exclude search term in email

[rdownie]

Is there a way to exclude the actual search string in the email generated out of an alert. I understand you can exclude results but is there a way to exclude the actual search string from the email There are times when there can be sensitive information in the actual string that you do not want to include in the alert email.

Thanks,

Bob

[supersleepwalke]

Two ways:

First way is to save the search, and give it a name (e.g. "My saved search"). DO NOT schedule this search. Then create a different scheduled search and use the savedsearch directive:

| savedsearch "My saved search"

Then the alert e-mail will only contain the above string, not the original query which might be sensitive.

Another way, less work, but also less assured. Splunk's alert e-mails only include the up to the first carriage return in your search. So, you can put some innocuous search stuff at the beginng. For instance:

index=*
index=sensitive key=value
| stats count by sensitivefield

When you get the alert e-mail, only the first line ("index=*") will be included.

[rdownie]

This works.

[jtrucks · Accepted solution]

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

[rdownie]

Yeah that is what I figured. I was hoping it was configurable.
Thanks,
-Bob

[rdownie]

I am guessing having it call a script to generate a custom email is the only way to do this?