Alerting

Splunk alert mails and its content

Deepz2612
Explorer

Hi,

Is there a way to get the list of Splunk alert mails being sent and the mail body content pls.

Tags (1)
0 Karma

whrg
Motivator

Hello @Deepz2612,

I use the following Splunk search for listing all triggered email alerts:

index=_audit source=audittrail sourcetype=audittrail alert_actions=email
| eval _time=trigger_time
| rename ss_name as Alert severity as Severity triggered_alerts as Count
| eval Severity=case(Severity==1,"Info",Severity==2,"Low",Severity==3,"Medium",Severity==4,"High",Severity==5,"Critical")
| table _time,Alert,Severity,Count | sort -_time

About the mail body content: I don't think that Splunk logs the mail body. I could not find it anywhere in the internal indexes. I would suggest that you send your alerts to an additional email address for logging purposes. (You can specify multiple email addresses separated by commas in the alert's settings.)

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...