How to getrid of the header info in a report

[xvxt006]

Hi,

we have scheduled a report and getting an email using Splunk. But we don't want to display the header info but we want just the actual data. For example below info we don't want to display. Is there an easy way not to display this info while getting an email.

Name: 'OrdersRevenueByHour'
Query Terms: 'OrdersRevenue'
Link to results: http://ap506:8000/app/search/@go?sid=scheduler__xv__search__RMD5051b14c56cfffbdc_at_1389981720_19588...
Alert was triggered because of: 'Saved Search [OrdersRevenueByHour]: number of events(23)'

[linu1988 · Accepted solution]

Hello,
If you don't want the extra details or want to customize the output email you need to modify the default sendmail.py file fro your app. Please take a backup before do ant changes.

Go to [Splunk\etc\apps\[search\app_name]\bin\]the content carefully remove which ever part you don't require:

intro += "Saved search results.\n\n"

    if settings != None:
        user  = settings.get("user", None)
        if user:
            intro += "User: \'" + escape(user, plainText) + "\'\n"

    if ssName:
        intro += "Name: \'" + escape(ssName, plainText) + "\'\n"

    query = getarg(argvals, "ssquery", None)
    if query:
        intro += "Query Terms: \'" + escape(query, plainText) + "\'\n"

    ssLink = getarg(argvals, "sslink", None)
    if ssLink and not plainText:
        ssLink = "<a href=\"" + ssLink + "\">" + ssLink + "</a>"

    if ssLink:
        intro += "Link to results: " + ssLink + "\n";

    ssSummary = getarg(argvals, "sssummary", None)
    if ssSummary:
        intro += "Alert was triggered because of: \'" + escape(ssSummary, plainText) + "\'\n"

Thanks