Reporting
Highlighted

Sendemail command

Contributor

I use sendemail command in scheduled search which runs every 5 minutes .
search looks like
index=myindex user=* | table user host source| sendemail.py to="me@company.com" subject="SPLUNK alert" sendresults=true server=1.1.1.1

Even there are no results i receive message with text "No results".

Is it possible to exclude such messages?

Tags (2)
0 Karma
Highlighted

Re: Sendemail command

SplunkTrust
SplunkTrust

You could change your search to a regular alert and remove the sendemail command from the search. Then you get features such as filtering for number of results > 0 through the alert configuration.

Highlighted

Re: Sendemail command

Contributor

Sure but when I make it i receive on email table with my results and empty graph above it. I do not know where does this graph originates from? So I tried sendemail command.

0 Karma
Highlighted

Re: Sendemail command

SplunkTrust
SplunkTrust

What do you mean by empty graph above it?

0 Karma
Highlighted

Re: Sendemail command

Contributor

something like result of chart command execution but it is empty and has legend with specified field names which I used in my search (user host source).

0 Karma
Highlighted

Re: Sendemail command

SplunkTrust
SplunkTrust

Is that delivered as a PDF attachment?

0 Karma
Highlighted

Re: Sendemail command

Contributor

yes, it is pdf attachment. My main goal is to get only table without message headers(alert name, link to results and etc.)

0 Karma
Highlighted

Re: Sendemail command

SplunkTrust
SplunkTrust

Turn off PDF delivery then, you won't get an empty graph anymore.

0 Karma
Highlighted

Re: Sendemail command

Contributor

But i will get alert name, link to results and etc. even if i turn off pdf delivery and include inline results(

0 Karma
Highlighted

Re: Sendemail command

SplunkTrust
SplunkTrust

Yup, those are hardcoded into the sendemail command. You can copy that python file and add your own command to splunk, say "mysendemail", and use that in alert_actions.conf. In there you can change how you'd like your mails to look.

0 Karma