Hi You can update It. But I suggest following below steps. Make sure your changes will be done in your app only. 1) Create a commands.conf. [sendemail] filename = my_sendmail.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true undo_scheduler_escaping = true is_risky = true local = true 2) Copy ./search/bin/sendemail.py to YOUR__APP/bin/my_sendmail.py Do not change in search/bin/sendemail.py file. Do appropriate changes in YOUR__APP/bin/my_sendmail.py only as per your requirements. Within your app, sendmail will work as per you made changes in my_sendmail.py Let me know for further assistance. Thanks ... View more

@Roozbeh59 You can't add or attach image to your email body through Splunk GUI. But can achieve it by sendemail.py.and the file will be available under this location $SPLUNK_HOME$/etc/apps/search/bin ... View more