Splunk Search

How to edit the table format in my email alert so that each item starts a new line?

omuelle1
Communicator

Hi Splunkers and Happy Friday

I am trying to put together an email that looks something like this:

alt text

However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:

alt text

The underlying search is this:

| fields - _raw, _time 
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS)  list(PACKQTY)  list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO 
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"

Would anybody know how to get this to have any value in the their own row and not right after each other?

Thank you very much guys,

Oliver

Tags (4)
1 Solution

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

View solution in original post

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

omuelle1
Communicator

I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.

0 Karma

ckunath
Communicator

Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...