Above solution doesn't work for me (Splunk 5.0.4) but I found a way to accomplish this very nicely by changing just one file instead of two
Edit ../etc/apps/search/bin/sendemail.py and comment out lines #189-213 as shown below.
(you'll need to change the file permissions from read-only first)
No need to restart Splunk, the change will be picked up at the next Alert
The "inline" alerts will show only the search results without any additional text.
The PDF or CSV alerts are not impacted by this change
sendemail.py section.....line 189
# else:
# intro += "Saved search results.\n\n"
# if settings != None:
# user = settings.get("user", None)
# if user:
# intro += "User: \'" + escape(user, plainText) + "\'\n"
# if ssName:
# intro += "Name: \'" + escape(ssName, plainText) + "\'\n"
# query = getarg(argvals, "ssquery", None)
# if query:
# intro += "Query Terms: \'" + escape(query, plainText) + "\'\n"
# ssLink = getarg(argvals, "sslink", None)
# if ssLink and not plainText:
# ssLink = "<a href=\"" + ssLink + "\">" + ssLink + "</a>"
# if ssLink:
# intro += "Link to results: " + ssLink + "\n";
# ssSummary = getarg(argvals, "sssummary", None)
# if ssSummary:
# intro += "Alert was triggered because of: \'" + escape(ssSummary, plainText) + "\'\n"
... View more
