Reporting

Saved search alert sending results in csv even though "plain" is specified.

cpenkert
Path Finder

I am running 4.2.3 and running into the following issue:

I have a saved search that runs, and if it has any results, it is configured to include the results in the email alert, with "plain" selected. The overall search server email settings are set to "plain" for Results Format when included inline.

Despite this, for a singled saved search and alerts from it, it is sending a csv. Any thoughts as to how this could possibly be happening?

Here is my alert_actions.conf contents:
[email]
format = plain
reportServerEnabled = 0
reportServerURL =

Tags (1)
0 Karma
1 Solution

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

View solution in original post

warrenpage
Explorer

Fixed this by adding

action.email.inline = 1

to the saved search.

Guessing old saved searches from previous versions didn't have this set.

 [AAATest]
 action.email = 1
 action.email.inline = 1
 action.email.sendresults = 1
 action.email.to = fred.bloggs@workdammit.com.au
0 Karma

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

cpenkert
Path Finder

Updated - here is the actual contents of my alert_actions.conf:
[email]
inline = 1
reportServerEnabled = 0
reportServerURL =
subject = Splunk Alert QED: $name$
format = plain

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...