https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616273#M1815 <P>_fields are often hidden so you could try renaming _raw to raw</P><LI-CODE lang="markup">| rename _raw as raw</LI-CODE> Fri, 07 Oct 2022 06:47:58 GMT ITWhisperer 2022-10-07T06:47:58Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616259#M1814 <P>How to include a full log-in Splunk alert message?</P> Fri, 07 Oct 2022 03:04:47 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616259#M1814 splunker_899 2022-10-07T03:04:47Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616273#M1815 <P>_fields are often hidden so you could try renaming _raw to raw</P><LI-CODE lang="markup">| rename _raw as raw</LI-CODE> Fri, 07 Oct 2022 06:47:58 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616273#M1815 ITWhisperer 2022-10-07T06:47:58Z https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616274#M1816 <P>Make sure the field _raw is included in your search results. Then you could use&nbsp;<SPAN>$result.</SPAN><I>_raw</I><SPAN>$ in an email alert for example.</SPAN></P><P><SPAN><A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Alert/Emailnotification" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.1/Alert/Emailnotification</A></SPAN></P><P>&nbsp;</P> Fri, 07 Oct 2022 06:51:21 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-include-full-log-in-Splunk-alert-message/m-p/616274#M1816 chaker 2022-10-07T06:51:21Z