Skip to content

Instantly share code, notes, and snippets.

@xpac1985
Created July 29, 2021 17:06
Show Gist options
  • Save xpac1985/5f4bcd7c2671b28003196556a9358a85 to your computer and use it in GitHub Desktop.
Save xpac1985/5f4bcd7c2671b28003196556a9358a85 to your computer and use it in GitHub Desktop.
Splunk sendemail.py modified to allow sender/from to be a variable/token
### actual position in file may vary depending on your Splunk version, but you get the idea
*** 574,593 ****
--- 574,596 ----
if ssContent.get('action.email.cc'):
stringsForPost['action.email.cc'] = ssContent['action.email.cc']
if ssContent.get('action.email.bcc'):
stringsForPost['action.email.bcc'] = ssContent['action.email.bcc']
if ssContent.get('action.email.to'):
stringsForPost['action.email.to'] = ssContent['action.email.to']
+ if ssContent.get('action.email.from'):
+ stringsForPost['action.email.from'] = ssContent['action.email.from']
+
if ssContent.get('action.email.subject'):
stringsForPost['action.email.subject'] = ssContent['action.email.subject']
if ssContent.get('action.email.footer.text'):
# SPL-144752: allow footer to have no value at all if user choose to not have it.
# This can be done by setting footer = " " (note the space in between)
if len(ssContent['action.email.footer.text'].strip()) > 0:
stringsForPost['action.email.footer.text'] = ssContent['action.email.footer.text']
realizeURI = entity.buildEndpoint([ 'template', 'realize' ])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment