Reporting

Saved search alert sending results in csv even though "plain" is specified.

cpenkert
Path Finder

I am running 4.2.3 and running into the following issue:

I have a saved search that runs, and if it has any results, it is configured to include the results in the email alert, with "plain" selected. The overall search server email settings are set to "plain" for Results Format when included inline.

Despite this, for a singled saved search and alerts from it, it is sending a csv. Any thoughts as to how this could possibly be happening?

Here is my alert_actions.conf contents:
[email]
format = plain
reportServerEnabled = 0
reportServerURL =

Tags (1)
0 Karma
1 Solution

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

View solution in original post

warrenpage
Explorer

Fixed this by adding

action.email.inline = 1

to the saved search.

Guessing old saved searches from previous versions didn't have this set.

 [AAATest]
 action.email = 1
 action.email.inline = 1
 action.email.sendresults = 1
 action.email.to = fred.bloggs@workdammit.com.au
0 Karma

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

cpenkert
Path Finder

Updated - here is the actual contents of my alert_actions.conf:
[email]
inline = 1
reportServerEnabled = 0
reportServerURL =
subject = Splunk Alert QED: $name$
format = plain

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...