The built-in email alerting functionality is fairly limited to the degree at which you can customize or control the content of the email itself. There's lots of stuff I'd like to be able to do that I can't right now, for example:
- Issue a "CC" (or BCC) instead of just "TO". (I'd also like the ability to note splunk user names, and then let splunk convert that to their listed email address.)
- Automatically show "_time" as something humanly readable. (I know there are timezone issues here.)
- Customize or control the layout or content of the email body.
- I'd like to be able to hide (or push to the bottom the actual search string.) Because (1) non-technical or non-splunk users just find that confusing, and (2) for me, I have some long complicated searches with just a small table; so I have to scroll around for awhile on my blackberry just to get to the results table. *. I'd like to be able to add some simple template text to the output. (Or perhaps, just include the searches "description". We have several alerts that need additional explication.)
- I'd like to be able to alter the subject line independently of the search name. It would also be nice to include some value from the results within the subject. (Something like "
Disk Error on host $results[0].host$"). - Modify the from address per search.
- Add links to splunk views. Either within the body of the email, or within the table results (for a per-row hyperlink).
- Including more than one search would be helpful from time to time. (Sure you can email PDF views, but they are pretty limited, and they load much slower than HTML content; especially on mobile devices.)
That's just off the top of my head. I know I can go hack the sendemail.py but that's a long-term maintenance nightmare.
Has anybody build some kind of app that augments/hijacks/replaces the out-of-the-box email alerting functionality?