Saved search alert sending results in csv even though "plain" is specified.

[cpenkert]

I am running 4.2.3 and running into the following issue:

I have a saved search that runs, and if it has any results, it is configured to include the results in the email alert, with "plain" selected. The overall search server email settings are set to "plain" for Results Format when included inline.

Despite this, for a singled saved search and alerts from it, it is sending a csv. Any thoughts as to how this could possibly be happening?

Here is my alert_actions.conf contents:
[email]
format = plain
reportServerEnabled = 0
reportServerURL =

[warrenpage]

Fixed this by adding

action.email.inline = 1

to the saved search.

Guessing old saved searches from previous versions didn't have this set.

 [AAATest]
 action.email = 1
 action.email.inline = 1
 action.email.sendresults = 1
 action.email.to = fred.bloggs@workdammit.com.au

[cpenkert · Accepted solution]

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

[cpenkert]

Updated - here is the actual contents of my alert_actions.conf:
[email]
inline = 1
reportServerEnabled = 0
reportServerURL =
subject = Splunk Alert QED: $name$
format = plain