Getting Data In

Question in sendemail.py

hjwang
Contributor

i found the part of code in sendemail.py is as follow:

if  len(results) != 0:
        cols = []
        for k,v in results[0].items():
           **# ignore attributes that start with "_"
           if k.startswith("_") and k!="_raw" and k!="_time":
               continue**
           cols.append(k)

        # output column names
        for col in cols:
            text += "<th>" + col + "</th>"
        text += "</tr>\n"
        # output each result's values
        for result in results:
            text += "<tr valign=top>"
            for col in cols:
                val = result.get(col, "")
                escval = saxutils.escape(val)
                text += "<td><pre>" + escval + "</pre></td>"
            text += "</tr>\n"
        text += "</table>"
return text

in this code, the column starts with "_" will be ignore and should not be append into cols list, but i found the search result in email alert still contain this column, unless i use field- command then it would be removed, do i missunderstand it? thanks and regards,

Tags (2)
0 Karma
1 Solution

southeringtonp
Motivator

What field is showing up that you don't want? Is it _time?

The script should remove all columns that begin with an underscore, except for _time and _raw.

If either of those is your unwanted field, then yes, you'll to either use fields - to get override the sendemail script with your own version.

View solution in original post

0 Karma

southeringtonp
Motivator

What field is showing up that you don't want? Is it _time?

The script should remove all columns that begin with an underscore, except for _time and _raw.

If either of those is your unwanted field, then yes, you'll to either use fields - to get override the sendemail script with your own version.

0 Karma

hjwang
Contributor

Thanks,southeringtonp, now i understand.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...