Splunk Search
Highlighted

Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Example search:

| sendemail to=$result.to$ subject=$result.subject$ message=$result.body$

I'm currently pulling the body field from a lookup table, and would like to include some kind of line break in the lookup itself (such as a br tag) to format in the email dynamically. It doesn't seem doable as Splunk or sendemail.py is encoding html characters thus not rendering it as html.

I could use the sendresults app, however currently it doesn't support dynamic fields for subject/body, but it does accept html.

Thoughts?

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

SplunkTrust
SplunkTrust

You could replace {msg|h} with {msg} in sendemail.py to allow inclusion of HTML tags in emails - with all the up- and downsides.

View solution in original post

Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Working nicely - thanks again for the assistance.

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

SplunkTrust
SplunkTrust

Keep in mind, this won't survive an upgrade of Splunk and might technically not be supported.

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Noted - enough to get by for a current project.

0 Karma