Alerting

Multiple Email Alert Types

Greg_LeBlanc
Path Finder

In alerts_actions.conf I can set up my email alert actions. I have it set so the saved search results display as a CSV attachment. Is there any way to have them displayed in-line as well? I've tried playing with "inline=true" but it seems to only allow one way or another.

Just wondering if anyone has figured out a way to do both.

0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Currently there is no way to do both via config. You could certainly modify sendemail.py - the script that is responsible for sending out the email to inline and attach.

View solution in original post

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Currently there is no way to do both via config. You could certainly modify sendemail.py - the script that is responsible for sending out the email to inline and attach.

0 Karma

Greg_LeBlanc
Path Finder

I'll go ahead and do that! Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...