Alert Trigger Send Email Default message -> can I change it ?

[SewingMachine77]

Can I change the default message in the Alert Trigger "Send Email" ? I have been looking around and cant find anything where I could change this. My goal is to create a template message so we can stream light our alert messages. Any help would be great !

[SewingMachine77]

Really what I want is to replace that default text to something like this ( Below ) Instead of the Message in the picture above.

Example:

Alert Description: 

Alert Steps:

1.  Look at it
2. Do Something

Alert Escalation: 

Alert Updating: 

[burwell · Accepted solution]

Hi in addition to using tokens as was suggested you can template the body of the message by configuring alert_actions.conf

For example you could have an alert_actions.conf (don't update the etc/system/default one) and add

[email]
message.alert = Please fill this report in as follows\
Step 1\
Step 2\
\
And finally\
Step 3

I use the \ because you want the message.alert value to span multiple lines. That should get you something like the attached screenshot.  

More details here 

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf

[tej57]

Hello @SewingMachine77,

I do not think there is a possibility to create templates and use them in the alerts. However, you can definitely customize the message for the saved search. Additionally, you can also use the search job tokens and use them in the message.

Refer to the following document for assistance with search job tokens: https://docs.splunk.com/Documentation/Splunk/9.2.1/Alert/EmailNotificationTokens

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.