Splunk Search

Splunk Email Alerts Change

Path Finder

So we recently upgraded to v6.1 and through all the changes to the emails, the biggest thing that we miss is that the borders are gone on the chart/table emails. Has anyone found a way to get these back? A lot of our emails have become much harder to read now that they are missing.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi jmheaton,

I would not copy the old sendemail.py from any Splunk < 6.x Version into Splunk v6.x. There were too many changes in the script itself.

If you take a closer look at the sendemail.py script at $SLPUNK_HOME/etc/apps/search/bin/ you can find at line 636 something like this:

        <table cellpadding="0" cellspacing="0" border="0" class="results" style="margin: 20px;">

this is the start of the result table. You can see it has set border="0", I assume if you change it to border="1" you will get back the borders. This is un-tested!

Also keep in mind, that changes in this script can be overwritten by a Splunk update without notice, so be careful.

hope this helps ...

cheers, MuS

View solution in original post

Path Finder

MuS,

My table has changed colors 😞

0 Karma

Champion

def htmlTableTemplate

`<th style="text-align: left;

add color: blue/red.. for splunk 6`

0 Karma

Path Finder

w.writerow(header)
# output each result's values
for result in results:
row = [esc(result.get(col,"")) for col in header]
w.writerow(row)
return s.getvalue()

COL is for COLUMN or for COLOR ?

0 Karma

SplunkTrust
SplunkTrust

look for something like header in the sendemail.py script and see if there is any color set, if yes change it to your needs.

0 Karma

Path Finder

header color is changed

0 Karma

Path Finder

version...upgrade from 5.0.3 to 6.0.4

0 Karma

SplunkTrust
SplunkTrust

well, what have you changed?

0 Karma

SplunkTrust
SplunkTrust

Hi jmheaton,

I would not copy the old sendemail.py from any Splunk < 6.x Version into Splunk v6.x. There were too many changes in the script itself.

If you take a closer look at the sendemail.py script at $SLPUNK_HOME/etc/apps/search/bin/ you can find at line 636 something like this:

        <table cellpadding="0" cellspacing="0" border="0" class="results" style="margin: 20px;">

this is the start of the result table. You can see it has set border="0", I assume if you change it to border="1" you will get back the borders. This is un-tested!

Also keep in mind, that changes in this script can be overwritten by a Splunk update without notice, so be careful.

hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

you're welcome 😉

0 Karma

Path Finder

Their are two lines in the sendemail.py script that i found with that data string. The first one edits the top table with elements such as the Search String / Alert Name. The second however was the one that put the border back on the cells. Thanks much!

Champion

if you have any other older version of splunk just copy replace the sendemail.py file.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!