I am running 4.2.3 and running into the following issue:
I have a saved search that runs, and if it has any results, it is configured to include the results in the email alert, with "plain" selected. The overall search server email settings are set to "plain" for Results Format when included inline.
Despite this, for a singled saved search and alerts from it, it is sending a csv. Any thoughts as to how this could possibly be happening?
Here is my alert_actions.conf contents:
[email]
format = plain
reportServerEnabled = 0
reportServerURL =
Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues
Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)
Fixed this by adding
action.email.inline = 1
to the saved search.
Guessing old saved searches from previous versions didn't have this set.
[AAATest]
action.email = 1
action.email.inline = 1
action.email.sendresults = 1
action.email.to = fred.bloggs@workdammit.com.au
Let me do the honor of answering my own question. Apparently this is a known issue and continues to be with the 4.3.2 version. This is a fairly big problem for us, as well as anyone else who does automatic parsing of the email alerts.
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues
Email alert sends attachment in csv despite format=plain being set in alert_actions.conf or action.email.format=plain in savedsearches.conf. (SPL-38858)
Updated - here is the actual contents of my alert_actions.conf:
[email]
inline = 1
reportServerEnabled = 0
reportServerURL =
subject = Splunk Alert QED: $name$
format = plain