Splunk Search

How to select fields for email alert

Jaci
Splunk Employee
Splunk Employee

Is there any way to control the reported fields in an email alert? I have configured splunk to add the search results inline, but I don't need all the fields it is showing. I only want the host and _raw fields to show up in the email. Can you point me in the direction where I can change this behavior?

2 Solutions

Dan
Splunk Employee
Splunk Employee

You can control this by appending "| fields + host,_raw" to the search string

View solution in original post

CerielTjuh
Path Finder

If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.

View solution in original post

CerielTjuh
Path Finder

If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.

Jaci
Splunk Employee
Splunk Employee

Thank you for the answer, this is helpful.

0 Karma

Dan
Splunk Employee
Splunk Employee

You can control this by appending "| fields + host,_raw" to the search string

Jaci
Splunk Employee
Splunk Employee

This is exactly what I was looking for. Thank you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...