Reporting

How do i customize scheduled search alert emails

Chris_R_
Splunk Employee
Splunk Employee

I would like to customize the scheduled alert email contents beyond what is included in the default email look and feel, how do i do so?

1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

View solution in original post

gdavid
Path Finder

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script.

\Splunk\etc\apps\search\local\commands.conf
[sendemail]
filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py
streaming = false
run_in_preview = false

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...