Reporting

How do i customize scheduled search alert emails

Chris_R_
Splunk Employee
Splunk Employee

I would like to customize the scheduled alert email contents beyond what is included in the default email look and feel, how do i do so?

1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

View solution in original post

gdavid
Path Finder

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script.

\Splunk\etc\apps\search\local\commands.conf
[sendemail]
filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py
streaming = false
run_in_preview = false

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...