Alerting

Updating text color based on condition using sendemail.py

mnj1809
Path Finder

Hello,

I've below dataset from Splunk search.

Namepercentage
A71%
B90%
C44%
D88%
E78%

 

All I need to change the percentage field values color as per below rule in the email alert. My requirement to achieve this by updating the sendemail.py.

95+ green, 80-94 amber, <80 = red

@tscroggins @ITWhisperer @yuanliu @bowesmana 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Let me clarify: When you say "color", you are talking about converting percentage text to a string representation of color code, not to color the percentage text in E-mail alert.  Correct?  In other words, you want something like

Namecolorpercentage
Ared71
Bamber90
Cred44
Damber88
Ered78

Because while potentially doable (and likely will involve a custom command you need to develop externally), Splunk doesn't provide such a function to color text used in E-mail alerts.  If this is the correct requirement, look up documentation for case

I further assume that your "percentage" field doesn't come with a percent sign (%); if you want that % in E-mail, you can always add it after color mapping.

 

| eval color = case(percentage < 80, "red", percentage < 95, "amber", true(), "green")

 

Here is a data emulation you can play with and compare with real data

 

| makeresults format=csv data="Name,	percentage
A,	71%
B,	90%
C,	44%
D,	88%
E,	78%"
| eval percentage = replace(percentage, "%", "")
``` data emulation above ```

 

Hope this helps.

Tags (1)
0 Karma

mnj1809
Path Finder

Thanks Yuanliu for your quick reply.

Yes, I need % sign included. In the email body I need to color the data of percentage column like below:

mnj1809_0-1713419590140.png

@yuanliu 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You recognize that this is a Splunk forum where volunteers offer help related to Splunk, right?  As I said, Splunk does not "color" search results. (The only coloring function in Splunk is provided in dashboard visualization.)  If you want to color text, you will need to develop something external to Splunk.  As you suggested, you can possibly achieve this by modifying sendmail.py (not recommended).  Alternatively, you can develop a custom command for this.  Either way, this is not the right forum.

0 Karma

mnj1809
Path Finder

Thanks @yuanliu for your quick response.

I am totally unaware how to achieve this by creating a custom command.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'd simply say don't go down this path.

sendemail.py is quite well written but a bit confusing for a non-experienced pythoneer. So you'll put a lot of effort for just one use-case. Additionally you'll get stuck with something you'll have to maintain yourself (what if there are updates to the main sendemail.py? What if there are security fixes? Will you backport those?).

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Start with this doc: Write Custom Search Commands.

Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...