• Overview
  • Overview
• User Interface
  • User Interface
    • Skinning SplunkWeb
  • Splunk toolbar for Firefox
  • Permalinks
    • Parameters
    • Unsupported Parameters
    • Examples
  • Configuring SplunkWeb
    • Skins
    • Localization
  • Scripting the Splunk search command
  • REST API
    • Messages
    • Authentication
    • Search
    • Enabling/disabling REST configuration options
    • Examples
  • SOAP API
    • How Splunk uses SOAP
    • Using the PCL to Make SOAP Requests
    • Additional PCL Search Examples
    • Creating SOAP Requests
    • SOAP Message Examples
    • SOAP error messages
• Data Inputs
  • Data Inputs
  • Input config
  • Scripted inputs
    • Configuration
    • Example
  • Understanding modules and processors
    • Default processors and pipelines
    • Pipeline data keys
    • Changing the default parsing and indexing sequence
    • Adding custom processors
  • Coding C/C++ processors
    • Writing Your Callback Function
    • Write Main
    • Add a Processor Config Stanza to Pipeline
  • Complete C Example
  • Complete C++ Example
  • Selecting events to process with a bundle
    • Create the Processor
    • Create the Module
    • Create the Bundle
    • Add an Additional Processor
• Data Outputs
  • Data Outputs
  • Customizing alert options
    • Email alerts
  • CLI for search
    • Actions
    • Default Argument
    • Parameters
    • Example
  • TCP Output
  • XML API for data output
• Management
  • Management
  • Authentication
    • Command Authentication
    • Parameters
    • Examples
    • Session Authentication
    • Examples
  • CLI for management
    • User Accounts
    • Controls
  • Configuring splunkd
    • Creating default logins on first startup
    • Changing the SSL configuration
  • XML API for management

Customizing alert options

Email alerts

Limited customization can be done via alert_actions.conf to specify the message subject and From: address used for alert emails.
Before making modifications to any configuration file, please see about bundles. See this page for details of the alert_actions.conf file.

[email]
# from email address
from=splunk@splunkalerts.com

# subject of the email
subject=Splunk Results

If you need additional customization, you can edit sendemail.py in $SPLUNK_HOME/etc/searchscripts. This is called for each alert, must be named sendemail.py and will be overwritten on upgrade. Save a copy of your changes in a safe location for future reference.

Warning Keep a backup copy of the original version so you can revert in the event of a problem. Test your changes carefully. For more information on the Python language, see http://www.python.org.

The mail() function, called by splunkd for each alert email, formats and sends the message using arguments configured in alert_actions.conf and internal defaults. You can modify the location of the mail server or the contents of the message header by changing the value of the variables defined at the top of the function:

    serverURL = argvals.get("server", "localhost")
    sender    = argvals.get("from", "splunk@" + socket.gethostname())
    to        = argvals.get("to", None)
    cc        = argvals.get("cc", None)
    bcc       = argvals.get("bcc", None)
    subject   = argvals.get("subject", "Splunk Results")
    format    = argvals.get("format", "html")
    importance= argvals.get("priority", None)

• serverURL = the mail server that Splunk will use to send the email
• sender = the address (Please specify this in alert_actions.conf file)
• to = the intended recipient (Please specify this in alert_actions.conf file)
• cc = the copied recipient (Please specify this in alert_actions.conf file)
• bcc = the blind copied recipient (Please specify this in alert_actions.conf file)
• subject = the subject of the message (Please specify this in alert_actions.conf file)
• format = whether the message is plain text or html (Please specify this in alert_actions.conf file)
• importance = the priority the messages

If you are interested in changing the format of the email, note that the variable bodytext contains the text of the message body, including search results.