Sendemail command

[andrey2007]

I use sendemail command in scheduled search which runs every 5 minutes .
search looks like
index=myindex user=* | table user host source| sendemail.py to="me@company.com" subject="SPLUNK alert" sendresults=true server=1.1.1.1

Even there are no results i receive message with text "No results".

Is it possible to exclude such messages?

[martin_mueller]

You could change your search to a regular alert and remove the sendemail command from the search. Then you get features such as filtering for number of results > 0 through the alert configuration.

[andrey2007]

Yes I had to choose this way and now i am modifying sendemail.py in search app.

[martin_mueller]

Yup, those are hardcoded into the sendemail command. You can copy that python file and add your own command to splunk, say "mysendemail", and use that in alert_actions.conf. In there you can change how you'd like your mails to look.

[andrey2007]

But i will get alert name, link to results and etc. even if i turn off pdf delivery and include inline results(

[martin_mueller]

Turn off PDF delivery then, you won't get an empty graph anymore.

[andrey2007]

yes, it is pdf attachment. My main goal is to get only table without message headers(alert name, link to results and etc.)

[martin_mueller]

Is that delivered as a PDF attachment?

[andrey2007]

something like result of chart command execution but it is empty and has legend with specified field names which I used in my search (user host source).

[martin_mueller]

What do you mean by empty graph above it?

[andrey2007]

Sure but when I make it i receive on email table with my results and empty graph above it. I do not know where does this graph originates from? So I tried sendemail command.