Alerting

Remove query and table header from Emails

Andruep
Engager

Is there any way to remove the query and table header information from alerts? I am aware of a previous question on the topic however there has not been a solution since that posting. Basically some of my alerts will be sent to smartphones and I would like to remove as much content as possible and only provide meaningful fields.

Tags (2)

kknopp
Path Finder

If I were to do something like the above, can I still have it trigger only if there are results? I have started using CASE recently, but that doesn't seem like an appropriate method here...

0range
Communicator

Really, seems like direct sendemail command disables all the alerting conditions, isn't it?

0 Karma

southeringtonp
Motivator

See also this earlier thread. A couple of possibilities:

  • Run a scheduled search, but instead of using the normal alert mechanism, call the sendemail command directly, e.g., |sendemail to=user@domain.com subject="Something" sendresults=true
  • Roll your own version of the emailer script (see thread 6423 for more detail).
  • southeringtonp
    Motivator

    By default, it will use localhost as the mail server. If you want to use a remote server, you can add another parameter server=mail.yourdomain.com

    0 Karma

    Andruep
    Engager

    Thanks for the suggestion, however, I received the error below after adding the sendemail string to the end of my search.

    [Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: abc@abc.org.

    abc@abc.org is a filler email address. My actual email address was used.

    0 Karma
    Get Updates on the Splunk Community!

    Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

    At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

    [Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

    Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

    New Year. New Skills. New Course Releases from Splunk Education

    A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...