Reporting

How do i customize scheduled search alert emails

Chris_R_
Splunk Employee
Splunk Employee

I would like to customize the scheduled alert email contents beyond what is included in the default email look and feel, how do i do so?

1 Solution

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

View solution in original post

gdavid
Path Finder

Does this still hold true for version 5.0.3? i'm trying to implement this and can't seem to make it point to the new script.

\Splunk\etc\apps\search\local\commands.conf
[sendemail]
filename = $SPLUNK_HOME/etc/apps/search/bin/my_sendemail.py
streaming = false
run_in_preview = false

0 Karma

Chris_R_
Splunk Employee
Splunk Employee

You would need to have a resource who can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py
I would advise making a copy of this script with another name

Thoroughly test the script changes as this would affect all outgoing alerts. Once you wish to use the new python email script you can point splunk to use it by creating a $SPLUNK_HOME/etc/apps/search/local/commands.conf

You will need a [sendemail] section to point to your new script.
[sendemail]
filename = your_sendemail.py
streaming = false
run_in_preview = false

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...