Is there any way to control the reported fields in an email alert? I have configured splunk to add the search results inline, but I don't need all the fields it is showing. I only want the host and _raw fields to show up in the email. Can you point me in the direction where I can change this behavior?
You can control this by appending "| fields + host,_raw" to the search string
If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.
If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.
Thank you for the answer, this is helpful.
You can control this by appending "| fields + host,_raw" to the search string
This is exactly what I was looking for. Thank you