Email templates

Email templates enable you to create reusable email notification templates for detector alerts. Instead of configuring email notification content separately on every detector, you can define a template once and apply it wherever you need consistent email notifications.

Each email template can include:

  • Recipients, including To, Cc, and Bcc addresses

  • Custom email headers for downstream routing or filtering

  • A triggered alert message

  • A resolved alert message

  • Variables that add contextual alert details to the subject, body, and supported header values

  • A test workflow that sends sample triggered and resolved emails before you use the template in production

Access email templates

To open the Email templates page:
  1. Log in to Splunk Observability Cloud.
  2. Select Alerts > Email templates.

Email template details

The Email templates page displays the list of existing templates if available. You can use the search field to find templates by name.

Email template page

The list of email templates displays the following details:

Field Description
Name The display name of the email template.
Creation Date The date and time when the template was created.
Created By The user who created the template.
Last Modified Date The date and time when the template was last updated.
Last Modified By The user who last modified the template.

Configure template

Enter the following template setting details:

Field Required Description
Name Yes A descriptive and unique name for the template. Use a name that helps users understand the purpose of the template, such as SRE On-Call Critical Alerts or Infrastructure Warning Notifications.
Email Recipients Yes The recipients who receive emails generated by this template. Add at least one To recipient. Cc and Bcc recipients are optional.
Custom Email Headers Optional The SMTP headers as key-value pairs. These headers are included in emails sent from the template.
Configure email template

Email recipient options

  • To: Primary recipients. At least one To recipient is required.

  • Cc: Optional copied recipients.

  • Bcc: Optional blind-copied recipients.

Custom email headers

Custom headers add invisible metadata to notification emails. They are useful when integrating with systems such as ITSM tools, ticketing systems, email filtering rules, or auto-response controls.

Customize message

Use this step to define the email content for triggered and resolved alert states.

Customize message

Triggered alert message

The message is sent when an alert triggers.

Field Description
Subject The subject line for the triggered alert email. Supports variables.
Body The message body for the triggered alert email. You can use the variables from the Available variables list.

Resolved alert message

The resolved message is sent when an alert is resolved. This includes cases where the condition is no longer met, the alert is resolved, or the detector is stopped.

Field Description
Subject The subject line for the resolved alert email. Supports variables.
Body The message body for the resolved alert email. You can use the variables from the Available variables list.

Available variables for customized message

You can use variables in subject lines, body content, and supported custom header values to add alert-specific context.

For example, the following table list a few variables that you can use:

Variable Description
{{detectorName}} Name of the detector that generated the alert.
{{ruleSeverity}} Severity of the alert rule, such as Critical, Warning, or Info.
{{incidentId}} Unique identifier for the incident.
{{dimensions.host}} Dimension value from the alert signal, such as the host name.
{{status}} Current status of the alert.
{{timestamp}} Timestamp for the alert event.
{{inputs}} Signal input values associated with the alert.
{{detectorTags}} Tags associated with the detector.
{{runbookUrl}} Runbook URL if one is configured for the detector.

Review and Save

Review the template summary before saving. The review step displays the following details that you have added:

  • Template name

  • Recipients, including To, Cc, and Bcc

  • Custom headers

  • Triggered alert subject and body

  • Resolved alert subject and body

Select Save to create the template.

Test an email template

After you save a template, use the test workflow to verify formatting, variable rendering, headers, and delivery before attaching the template to a detector. Testing uses synthetic sample alert data, so it doesn't create real alerts or incidents.

To test a template:

  1. Open the saved email template.
  2. Select Run Test.
  3. Select the log level that best matches the alert scenario you want to validate, such as Debug, Error, Warning, Informational, or Trace, so the rendered email content reflects the expected severity.
  4. Select Run Test.
If the test fails, review the error message. Common issues include invalid email addresses, variable syntax errors, missing required fields, unsupported custom header names, or recipient limits.

Use an email template with a detector

After you create and test an email template, attach it to a detector so alert notifications use the template's recipients, headers, and message content.

  1. Navigate to Alerts > Detectors.
  2. Create a new detector or edit an existing detector. For more information, see Create alerts, detectors, and service level objectives.
  3. In the detector configuration wizard, go to the Alert notifications section.
  4. Select Add recipient and select Email template.
  5. Select an existing email template from the list. Templates are listed by name.
    Email template in detector
  6. Save the detector.

Use templates and direct email recipients together

You can use both an Email template notification and direct Email recipients on the same detector.

  • Email template recipients receive the template-based email with the template's triggered or resolved content.

  • Direct email recipients receive the detector's standard email notification content.

  • Both notifications are delivered independently, even if the content is the same.