Documentation > Splunk > Developing Dashboards, Views, and Apps for Splunk Web > Customizing alert options

Developing Dashboards, Views, and Apps for Splunk Web

 


Overview
User Interface
Data Inputs
Data Outputs
Management

Customizing alert options

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Customizing alert options

Email alerts

Limited customization can be done via alert_actions.conf to specify the message subject and From: address used for alert emails.


Before making modifications to any configuration file, please see about bundles. See this page for details of the alert_actions.conf file. 


[email]
# from email address
from=splunk@splunkalerts.com
# subject of the email
subject=Splunk Results

If you need additional customization, you can edit sendemail.py in $SPLUNK_HOME/etc/searchscripts. This is called for each alert, must be named sendemail.py and will be overwritten on upgrade. Save a copy of your changes in a safe location for future reference.


Warning Keep a backup copy of the original version so you can revert in the event of a problem. Test your changes carefully. For more information on the Python language, see http://www.python.org.


The mail() function, called by splunkd for each alert email, formats and sends the message using arguments configured in alert_actions.conf and internal defaults. You can modify the location of the mail server or the contents of the message header by changing the value of the variables defined at the top of the function: 


    serverURL = argvals.get("server", "localhost")
    sender    = argvals.get("from", "splunk@" + socket.gethostname())
    to        = argvals.get("to", None)
    cc        = argvals.get("cc", None)
    bcc       = argvals.get("bcc", None)
    subject   = argvals.get("subject", "Splunk Results")
    format    = argvals.get("format", "html")
    importance= argvals.get("priority", None)

If you are interested in changing the format of the email, note that the variable bodytext contains the text of the message body, including search results.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/3.1.3/Developer/CustomizingAlertOptions"

This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.3 , 3.1.4 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!