Alerting

Generating Alert, ability to exclude search term in email

rdownie
Communicator

Is there a way to exclude the actual search string in the email generated out of an alert. I understand you can exclude results but is there a way to exclude the actual search string from the email There are times when there can be sensitive information in the actual string that you do not want to include in the alert email.

Thanks,

Bob

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

--
Jesse Trucks
Minister of Magic

View solution in original post

supersleepwalke
Communicator

Two ways:

First way is to save the search, and give it a name (e.g. "My saved search"). DO NOT schedule this search. Then create a different scheduled search and use the savedsearch directive:

| savedsearch "My saved search"

Then the alert e-mail will only contain the above string, not the original query which might be sensitive.

Another way, less work, but also less assured. Splunk's alert e-mails only include the up to the first carriage return in your search. So, you can put some innocuous search stuff at the beginng. For instance:

index=*
index=sensitive key=value
| stats count by sensitivefield

When you get the alert e-mail, only the first line ("index=*") will be included.

rdownie
Communicator

This works.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

--
Jesse Trucks
Minister of Magic

rdownie
Communicator

Yeah that is what I figured. I was hoping it was configurable.
Thanks,
-Bob

0 Karma

rdownie
Communicator

I am guessing having it call a script to generate a custom email is the only way to do this?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...