Reporting

Saved search alert sending results in csv even though "plain" is specified.

cpenkert
Path Finder

I am running 4.2.3 and running into the following issue:

I have a saved search that runs, and if it has any results, it is configured to include the results in the email alert, with "plain" selected. The overall search server email settings are set to "plain" for Results Format when included inline.

Despite this, for a singled saved search and alerts from it, it is sending a csv. Any thoughts as to how this could possibly be happening?

Here is my alert_actions.conf contents:
[email]
format = plain
reportServerEnabled = 0
reportServerURL =

Tags (1)
0 Karma
1 Solution

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

View solution in original post

warrenpage
Explorer

Fixed this by adding

action.email.inline = 1

to the saved search.

Guessing old saved searches from previous versions didn't have this set.

 [AAATest]
 action.email = 1
 action.email.inline = 1
 action.email.sendresults = 1
 action.email.to = fred.bloggs@workdammit.com.au
0 Karma

cpenkert
Path Finder

Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.

http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues

Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)

cpenkert
Path Finder

Updated - here is the actual contents of my alert_actions.conf:
[email]
inline = 1
reportServerEnabled = 0
reportServerURL =
subject = Splunk Alert QED: $name$
format = plain

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...