Reporting

What the SPLUNK?

jon_yarbrough
New Member

hi everyone, i'm new to Splunk and i've read through the tons of forums and i can't find the solution to my problem. what i'm trying to do is to change the headers and the information that is shown when an email alert is sent to me with the errors that i determined i would like to view. i have no idea where i can find the headers or where/how to create a custom search result. do i need to create a script or something and if i do, where does the script go? does it go in the scripts folder on the SPLUNK server or on the web base UI?

Tags (1)
0 Karma

gekoner
Communicator

In the WebGUI go to Manager --> Searches and Reports. Either create a new Saved Search (I wasn't sure if you had already created one or not) or edit the search you want change the email notification for.
Under the Schedule and alert section, mark the check-box labeled Schedule this search
You should then see all of the fields available for you to edit.
Under Alert actions, find Send email, and mark the check-box that says "Enable"

You can then modify the Email subject, Email address(es), and what to include in the results of your email.
For more options and functionality see this post -http://splunk-base.splunk.com/answers/621/email-alert-subject

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...