Prepending String to All Email Subjects

[fredclown]

Does anyone have a creative solution or know if there is an obscure way in Splunk to prepend a certain string to the beginning of email subjects that are sent from Splunk? I'm looking for something that users could not override when they create an alert or report. I do know about the email footer option in the email setup screen to add a static footer that cannot be altered by users and we do employ that as well. I'm trying to do something like this with the email subject. Thanks.

[VatsalJagani]

@fredclown - Email is just an alert action that comes default with Splunk. As you mentioned currently there is no option to prepend in the subject.

• You could raise as improvement in Splunk at https://ideas.splunk.com/
• Or you could have your own custom Splunk alert action for email with all the same options, but there of course you could specify whatever subject you want in your own Python code. But somehow you would have to disable Splunk's built in Email action, so people don't use that to bypass your rule.

I hope this helps!!! Kindly upvote if it does!!

[isoutamo]

Hi

it's just like @VatsalJagani said. 

What is the issue which you try to solve with this Fixed header part? Maybe there is another solution which you could use to achieve your objectives?

r. Ismo