Reporting

emailing saved searches without csv attachment

voxel
Engager

is there any way i can configure a saved search that will send me the results, but rather than attaching the results as a CSV attachment, put the raw log with the search results inline inside the email?

id like to look at the emailed alerts via email on my blackberry without opening/downloading csv files.

Tags (1)
1 Solution

the_wolverine
Champion

If you don't want inline results on a system-wide basis, you can configure results to be included inline by adding the following setting to a particular saved search (in saved searches.conf):

action.email.inline = 1

Obviously this requires access to the filesystem. I've filed an ER to make this a configurable option from the UI.

View solution in original post

the_wolverine
Champion

If you don't want inline results on a system-wide basis, you can configure results to be included inline by adding the following setting to a particular saved search (in saved searches.conf):

action.email.inline = 1

Obviously this requires access to the filesystem. I've filed an ER to make this a configurable option from the UI.

Simeon
Splunk Employee
Splunk Employee

There is an "inline" parameter in alert_actions.conf:

inline = <true | false>
    * Specify whether the search results are contained in the body of the alert email.
    * Defaults to false.

See more detail here:

http://www.splunk.com/base/Documentation/latest/Admin/Alertactionsconf

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...