I have an alert that looks for a pattern in an event that is an xml: ie.
":2017-03-01 06:02:16,194 INFO 7010 System Error 7025 Failed Request Build null null"
I want to send the email that includes only the TransactionStatusMessageDetail field, but I get the _raw sent
(Failed Request Build) is the field
Can this be done? Splunk Enterprise version is 6.1
Just add | table TransactionStatusMessageDetail
as the last part of your search.
Just add | table TransactionStatusMessageDetail
as the last part of your search.
Works like a champ!...thanks
Be sure to click Accept
to close the question.