Splunk Search
Highlighted

Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Example search:

| sendemail to=$result.to$ subject=$result.subject$ message=$result.body$

I'm currently pulling the body field from a lookup table, and would like to include some kind of line break in the lookup itself (such as a br tag) to format in the email dynamically. It doesn't seem doable as Splunk or sendemail.py is encoding html characters thus not rendering it as html.

I could use the sendresults app, however currently it doesn't support dynamic fields for subject/body, but it does accept html.

Thoughts?

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

SplunkTrust
SplunkTrust

You could replace {msg|h} with {msg} in sendemail.py to allow inclusion of HTML tags in emails - with all the up- and downsides.

View solution in original post

Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Working nicely - thanks again for the assistance.

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

SplunkTrust
SplunkTrust

Keep in mind, this won't survive an upgrade of Splunk and might technically not be supported.

0 Karma
Highlighted

Re: Using sendemail and pulling the body field from a lookup table, how can I include a line break in the lookup to format the email dynamically?

Builder

Noted - enough to get by for a current project.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.