https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90745#M1270 <P>As i know, splunk use the length of fields from shortest to longest by default, how to define the order in search command rather than modifing the sendemail.py. i try field - _raw,index,source,sourcetype + interface,status, but seems not to work, and the extract fields i defined are not shown in mail-format. i use v4.1.4, thanks</P> Wed, 17 Nov 2010 11:23:14 GMT hjwang 2010-11-17T11:23:14Z https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90745#M1270 <P>As i know, splunk use the length of fields from shortest to longest by default, how to define the order in search command rather than modifing the sendemail.py. i try field - _raw,index,source,sourcetype + interface,status, but seems not to work, and the extract fields i defined are not shown in mail-format. i use v4.1.4, thanks</P> Wed, 17 Nov 2010 11:23:14 GMT https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90745#M1270 hjwang 2010-11-17T11:23:14Z https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90746#M1271 <P>Hello,<BR /> By using the table we can set the order of the fields to display, if i got the question correctly!!</P> Thu, 25 Jul 2013 13:41:50 GMT https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90746#M1271 linu1988 2013-07-25T13:41:50Z https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90747#M1272 <P><A href="http://answers.splunk.com/answers/40540/how-can-i-keep-order-of-fields-in-plain-format-of-an-alert-email">http://answers.splunk.com/answers/40540/how-can-i-keep-order-of-fields-in-plain-format-of-an-alert-email</A></P> <P>In short, Splunk will reorder by field width on email even if you define them via 'table', or 'fields'. Refer to the above link to fix this issue.</P> Thu, 14 Aug 2014 02:28:42 GMT https://community.splunk.com/t5/Alerting/How-to-define-mail-alert-format/m-p/90747#M1272 wlkearns 2014-08-14T02:28:42Z