<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Question in sendemail.py in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100332#M21001</link>
    <description>&lt;P&gt;Thanks,southeringtonp, now i understand.&lt;/P&gt;</description>
    <pubDate>Tue, 07 Dec 2010 13:24:37 GMT</pubDate>
    <dc:creator>hjwang</dc:creator>
    <dc:date>2010-12-07T13:24:37Z</dc:date>
    <item>
      <title>Question in sendemail.py</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100330#M20999</link>
      <description>&lt;P&gt;i found the part of code in sendemail.py is as follow:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;if  len(results) != 0:
        cols = []
        for k,v in results[0].items():
           **# ignore attributes that start with "_"
           if k.startswith("_") and k!="_raw" and k!="_time":
               continue**
           cols.append(k)

        # output column names
        for col in cols:
            text += "&amp;lt;th&amp;gt;" + col + "&amp;lt;/th&amp;gt;"
        text += "&amp;lt;/tr&amp;gt;\n"
        # output each result's values
        for result in results:
            text += "&amp;lt;tr valign=top&amp;gt;"
            for col in cols:
                val = result.get(col, "")
                escval = saxutils.escape(val)
                text += "&amp;lt;td&amp;gt;&amp;lt;pre&amp;gt;" + escval + "&amp;lt;/pre&amp;gt;&amp;lt;/td&amp;gt;"
            text += "&amp;lt;/tr&amp;gt;\n"
        text += "&amp;lt;/table&amp;gt;"
return text
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;in this code, the column starts with "_" will be ignore and should not be append into cols list, but i found the search result in email alert still contain this column, unless i use field- command then it would be removed, do i missunderstand it? thanks and regards,&lt;/P&gt;</description>
      <pubDate>Tue, 07 Dec 2010 12:11:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100330#M20999</guid>
      <dc:creator>hjwang</dc:creator>
      <dc:date>2010-12-07T12:11:13Z</dc:date>
    </item>
    <item>
      <title>Re: Question in sendemail.py</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100331#M21000</link>
      <description>&lt;P&gt;What field is showing up that you don't want?  Is it &lt;CODE&gt;_time&lt;/CODE&gt;?&lt;/P&gt;

&lt;P&gt;The script should remove all columns that begin with an underscore, &lt;B&gt;except for &lt;CODE&gt;_time&lt;/CODE&gt; and &lt;CODE&gt;_raw&lt;/CODE&gt;.&lt;/B&gt;&lt;/P&gt;

&lt;P&gt;If either of those is your unwanted field, then yes, you'll to either use &lt;CODE&gt;fields -&lt;/CODE&gt; to get override the sendemail script with your own version.&lt;/P&gt;</description>
      <pubDate>Tue, 07 Dec 2010 12:42:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100331#M21000</guid>
      <dc:creator>southeringtonp</dc:creator>
      <dc:date>2010-12-07T12:42:44Z</dc:date>
    </item>
    <item>
      <title>Re: Question in sendemail.py</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100332#M21001</link>
      <description>&lt;P&gt;Thanks,southeringtonp, now i understand.&lt;/P&gt;</description>
      <pubDate>Tue, 07 Dec 2010 13:24:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Question-in-sendemail-py/m-p/100332#M21001</guid>
      <dc:creator>hjwang</dc:creator>
      <dc:date>2010-12-07T13:24:37Z</dc:date>
    </item>
  </channel>
</rss>

