Documentation:
3.1.4
This page last updated: 12/27/07 11:12pm
alert_actions.conf
Alert_actions.conf controls parameters for available alerting actions for scheduled searches.
alert_actions.conf.spec
# This file contains possible attributes and values for configuring saved search
# actions and alerting in alert_actions.conf.
#
# You can configure Splunk's global alerting actions by creating your own alert_actions.conf.
# There is an alert_actions.conf in $SPLUNK_HOME/etc/bundles/default/. To set custom configurations,
# place an alert_actions.conf in $SPLUNK_HOME/etc/bundles/local/ or your own custom bundle directory.
# Glabal options
maxresults = <int>
* Set the global maximum number of search results to be sent via alerts.
* Defaults to 100.
hostname = <string>
* Set the hostname that is displayed in the link sent in alerts.
* This is useful when the machine sending the alerts does not have a FQDN.
* Defaults to current hostname (set in Splunk) or localhost (if none is set).
# Email saved search actions
[<email saved search action>]
from = <string>
* Email address where the alert originates.
* Defaults to splunk@localhost
subject = <string>
* Specify an alternate email subject.
* Defaults to SplunkAlert-<splunkname>.
format = <string>
* Specify the format of the text in the email.
* Possible values include: plain, html and csv.
* The value for will also apply to any attachments as well as the text of an email.
inline = true | false | auto
* Specify whether the search results will be contained in the body of the alert email.
* Defaults to auto.
mailserver = <string>
* The SMTP mail server to use when sending emails.
* Defaults to localhost.
# RSS saved search actions
items_count = <number>
* Threshold of how many rss feeds will be saved.
* Defaults to 30.
# EXAMPLE alert_action.conf # # You can use this example configuration file to customize your scheduled alerts. [email] # from email address from=splunk@splunkalerts.com # by default the subject is SplunkAlert-<splunk-name>, but # you can change that here. subject=your daily splunk # specify the format of the text in the email with two # possible values: html, plain, csv format=html [rss] # threshold of rss feeds items_count=30
Comments
No comments have been submitted.