I want to get emails with out the whole body.

[blainsupplymis]

I been trying to find the best way to remove some of the extra stuff inside of the email body.
the current body looks like below
Saved search results.

Name: 'test-alert'
Query Terms: 'source=\"udp:514\" sourcetype=\"cisco_asa\"'
Link to results: https://blnmonitor:8000/app/search/@go?sid=scheduler__admin__search_dGVzdC1hbGVydA_at_1344613200_bea...
Alert was triggered because of: 'Saved Search [test-alert]: number of events(141)'

I want it to look something like this
On 2012-08-09 at approximately 17:19:23 BLNROUTER1 showed Chippewa Falls' T1 went up
or
Chippewa Fall's T1 went up

[blainsupplymis]

That one doesn't work. I need to make changes to the alert_actions.conf, but I don't have much experience with pyton. I know in what area to make the changes, but I don't know how to write my own.
here is where I need to make the changes
command = $action.email.preprocess_results{default=""}$ | sendemail

"server=$action.email.mailserver{default=localhost}$" "use_ssl=$action.email.use_ssl{default=false}$"

"use_tls=$action.email.use_tls{default=false}$" "to=$action.email.to$" "cc=$action.email.cc$"

"bcc=$action.email.bcc$" "from=$action.email.from{default=splunk@localhost}$"

"subject=$action.email.subject{recurse=yes}$" "format=$action.email.format{def"sssummary=Saved Search [$name$]: $counttype$($results.count$)" "sslink=$results.url$" "ssquery=$search$" "ssname=$name$" "inline=$action.email.inline{default=False}$" "sendresults=$action.email.sendresults{default=False}$" "sendpdf=$action.email.sendpdf{default=False}$" "pdfview=$action.email.pdfview$" "searchid=$search_id$" "width_sort_columns=$action.email.width_sort_columns$" "graceful=$graceful{default=True}$" ault=csv}$"

maxinputs="$action.email.maxresults{default=10000}$" maxtime="$action.email.maxtime{default=5m}$"

[yannK]

here is the answer to the same question :

http://splunk-base.splunk.com/answers/8532/remove-query-and-table-header-from-emails