The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: Splunkd vs. SplunkWeb | Next Topic: Lightforwarder to another Indexer
Posts 1–3 of 3
Has anyone else come across this issue?
Outlook 2007 does not display scheduled search results - it truncates the message. The source is intact and the message is displayed properly in mobile clients, including OWA.
*Begin Message
"Saved search results.
Name: 'Failed Remote Logons | All Systems ("
End Message**
That's all I see in the body of the email.
Yes I'm just seeing this now.
Splunk is not properly escaping angle brackets in the Query line:
When a "<" is used in your search, the HTML gets "unbalanced and Outlook gets confused.
If you right click the body of your e-mail and select view source you should see your entire message including the HTML which is not getting displayed.
Here's an example of a search which causes the problem for me:
Query Terms: 'index="uad-os" sourcetype="uad-diskspace" Mounted="/opt/psreports" (host=psdps* OR host=pspps*)|dedup host | convert num(Use) |search Use<65 |fields + host, Avail,Filesystem,Mounted,Size,Use, Used, tag::host| stats values(*) as * by host, Use |rename tag::host as "Host Tags",Use as "Percent Used"'
Conversely, my search reporting the opposite condition which includes a greater than character ">" does not cause the problem.
This was a pain to track down.
Splunk should probably wrap The "Query Terms:..." line in pre tags or escape all non-HTML into entity equiv.
Personally, I'd like an option which does not include all the garbage used to produce the results. I just want the results and a clean link to the results.
<a href="bigmessy-internal-splunk-url">Link to results</a>
Some more info:
As an Ubuntu user, I had assumed the rendering engine in Outlook 2007 was the same one used in IE. However I fired up a Windows VM and saved the email to a file and examined it in IE 7 the page rendered fine.
Doing some searching landed me on this page:
http://www.sitepoint.com/blogs/2007/01/10/microsoft-breaks-html-email-rendering-in-outlook/
I don't have any more time to look into this but, I'm still betting something from the "Query Terms:..." is throwing off the interpretation of the email as HTML in Outlook 2007.