I have a system set up where I am using map with sendemail to email out notifications (which is working fine). However I now want to add company branding into the email through using our HTML formatted template. I can't for the life of me get Splunk to recognize html tags even with content_type=html.
A simple test I have been trying to get working is as follows:
| sendemail content_type=html email@example.com subject="TEST" from=splunk@localhost footer=. message="<b>HELLO </b> This is a test"
With the above, the email comes through fine, I just get a literal string with no formatting applied. I have tried different encodings (URL, Base64), and escaping so far, but couldn't think of much else! I don't want anything too fancy, and would prefer not to roll my own sendemail.py if it can be avoided.
Splunk sends email message as plain-text. The content_type=html is for formatting of other contents set by Splunk like link to alerts, inline table with tabular formatting etc. This will in fact prevent malicious content to be embedded via message content as html.
Having said that please try to send message with email address and web URL which should get auto formatted. Also \n should get formatted as new line. This might work in Outlook with Auto Formatting turned on, however, behavior for Desktop App and Web App may vary and would need testing. Try changing content_type between html and plain for triggering alerts and check in both Desktop and Web App.
| sendemail content_type=html firstname.lastname@example.org subject="TEST" message="This is a test. \n Email To: email@example.com Link: http:\\localhost:8000 "
Also ideally footer should be modified to add signature. However, directly no formatting can be done on footer and you will have to rely on modifying sendemail.py for complete control of the email.