The dynamic substitution of the email subject failed because of failed token substitution.

[splunkxu]

Whenever splunk sends an email after a triggerd alert or scheduled report , an error occurs in function 'realize(...)', which is from sendemail.py .
As a result, the function sets email's subject and message back to default value forcefully.

Besides, each mail contains the following note:
"The dynamic substitution of the email subject failed because of failed token substitution."
Mail text customization becomes impossible due to this error.

p.s. Nothing about this error is recorded in splunkd.log. I dont find any error info.

Hope someone can help me out.
Thanks a lot.

Here is the related code from function 'realize(..)':

try:
    for key, value in stringsForPost.iteritems():
        if len(value.strip()) == 0:
            logger.warning('Token substitution may fail due to key:%s contains only whitespaces' % key)
        postargs['name'] = value
        headers, body = simpleRequest(
            realizeURI, 
            method='POST', 
            postargs=postargs, 
            sessionKey=sessionKey
        )
        body = json.loads(body)
        ssContent[key] = body['entry'][0]['content']['eai:data']
except Exception as e:
    logger.error(e)
    # SPL-96721: email subject didn't get replaced, reset it to ssname
    if ssContent.get('action.email.subject') == stringsForPost.get('action.email.subject'):
        ssContent['action.email.subject'] = "Splunk Alert:"+argvals['ssname']
        ssContent['action.email.message'] = ssContent['action.email.message'] + "\n\nNOTE: The dynamic substitution of the email subject failed because of failed token substitution. A generic subject has been used instead. Please check splunkd.log for additional details."

---

[woodcock]

Definitely open a support case and come back here and update us on what you learn, especially if it gets resolved.

[zchiml]

After upgrading splunk to higher edition, we encounter same problem when sending mail by alert trigger, there is one error log in python.log (splunk 8.0.0 on Windows 7)

2019-11-13 16:18:03,134 +0800 ERROR sendemail:560 - 'utf8' codec can't decode byte 0xa8 in position 12: invalid start byte

after the error, splunk will send an email with default subject "Splunk Alert:$name$" and the message "The dynamic substitution of the email subject failed because of failed token substitution"

the code piece is same as above question.

We have tried 3 splunk edition, 7.3.1, 7.3.2, 8.0.0, all have the same problem on Windows 7 and Window 10, but our old edition 7.1.1 is working fine.

Appreciating any help.