Structure modification of message alert

[evang_26]

Hello Splunk users,

I am eager to know if there is any way to modify the message generated by alerts in terms of structure in order to make it a little bit shiny. Whenever I receive an email alert, is kind of just letters and only a simple html-like table. I want to modify the colors, table and so on.
Could you please me tell where to look to, so as to modify the code there?

Any suggestions are greatly appreciated!
Evang

[tararso · Accepted solution]

You can modify sendemail.py located under $SPLUN_KHOME\etc\apps\search\bin.

[MuS]

Just a reminder: sendemail.py could be overwritten by any Splunk update. So keep that in mind if you change it 😉

[evang_26]

Thanks again Tararso,

I'll try to make it done and let you know.

Regards,
Evang

[tararso]

not in the manager. You need to open sendemail.py from splunk installed folder which is located under $SPLUN_KHOME\etc\apps\search\bin

[evang_26]

Hi Tararso,

Thanks for your reply. I am new to Splunk, would you mind guide me through the $SPLUN_KHOMEetcappssearchbin?
Is it somewhere on the manager?

Thanks,
Evang