Reporting

How do i customize scheduled search alert emails

Chris_R_
Splunk Employee
Splunk Employee

I would like to customize the scheduled alert email contents beyond what is included in the default email look and feel, how do i do so?

1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

View solution in original post

gdavid
Path Finder

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script.

\Splunk\etc\apps\search\local\commands.conf
[sendemail]
filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py
streaming = false
run_in_preview = false

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.