Alerting

Generating Alert, ability to exclude search term in email

rdownie
Communicator

Is there a way to exclude the actual search string in the email generated out of an alert. I understand you can exclude results but is there a way to exclude the actual search string from the email There are times when there can be sensitive information in the actual string that you do not want to include in the alert email.

Thanks,

Bob

0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

View solution in original post

supersleepwalke
Communicator

Two ways:

First way is to save the search, and give it a name (e.g. "My saved search"). DO NOT schedule this search. Then create a different scheduled search and use the savedsearch directive:

| savedsearch "My saved search"

Then the alert e-mail will only contain the above string, not the original query which might be sensitive.

Another way, less work, but also less assured. Splunk's alert e-mails only include the up to the first carriage return in your search. So, you can put some innocuous search stuff at the beginng. For instance:

index=*
index=sensitive key=value
| stats count by sensitivefield

When you get the alert e-mail, only the first line ("index=*") will be included.

rdownie
Communicator

This works.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Write a short script that is triggered to send email with a custom subject and body rather than using the built-in email alert reporting. It could be something as simple as a shell script that runs:

mail -s "This is a search alert message" user@domain.tld < /dev/null

Or the equiv on your system.

View solution in original post

rdownie
Communicator

Yeah that is what I figured. I was hoping it was configurable.
Thanks,
-Bob

0 Karma

rdownie
Communicator

I am guessing having it call a script to generate a custom email is the only way to do this?

0 Karma