https://community.splunk.com/t5/Alerting/Help-with-looping-in-Splunk-getting-column-names-along-with/m-p/579847#M13352 <P>The foreach command will iterate through a list of field names.</P><P>An alert is based on the results of a search - it looks like you already have a search, what more do you need for your alert?</P> Tue, 04 Jan 2022 09:18:06 GMT ITWhisperer 2022-01-04T09:18:06Z https://community.splunk.com/t5/Alerting/Help-with-looping-in-Splunk-getting-column-names-along-with/m-p/579846#M13351 <P>Hi everyone,&nbsp;</P><P>I would like to retrieve all the column names and the field values for each row and put them in an alert, without manually doing it.&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="yoshilog_0-1641286314132.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17406i6EEFB3C1593FAEDD/image-size/medium?v=v2&amp;px=400" role="button" title="yoshilog_0-1641286314132.png" alt="yoshilog_0-1641286314132.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">yoshilog_0-1641286314132.png</span></span></P><P>&nbsp;</P><P>Could you let me know if it is possible to iterate through each column name in splunk?</P><P>My desired output looks like this:&nbsp;<BR /><BR /></P><P>① [This is for Row labeled ①]</P><P><STRONG>journal.status_id.old_value:</STRONG> 90<BR /><STRONG>journal.status_id.new_value:</STRONG> 95</P><P>②[This is for Row labeled ②]</P><P><STRONG>journal.assigned_to_id.old_value: </STRONG>113<BR /><STRONG>journal.assigned_to_id.new_value:&nbsp;</STRONG>99</P><P>③[This is for Row labeled ③]</P><P><STRONG>journal.status_id.old_value: </STRONG>73<BR /><STRONG>journal.status_id.new_value:&nbsp;</STRONG>90<BR /><BR /><STRONG>journal.assigned_to_id.old_value: </STRONG>null<BR /><STRONG>journal.assigned_to_id.new_value:&nbsp;</STRONG>113</P><P><BR />It is possible for other columns to be present so I would like to do it via a loop.&nbsp;</P> Tue, 04 Jan 2022 08:59:33 GMT https://community.splunk.com/t5/Alerting/Help-with-looping-in-Splunk-getting-column-names-along-with/m-p/579846#M13351 yoshilog 2022-01-04T08:59:33Z https://community.splunk.com/t5/Alerting/Help-with-looping-in-Splunk-getting-column-names-along-with/m-p/579847#M13352 <P>The foreach command will iterate through a list of field names.</P><P>An alert is based on the results of a search - it looks like you already have a search, what more do you need for your alert?</P> Tue, 04 Jan 2022 09:18:06 GMT https://community.splunk.com/t5/Alerting/Help-with-looping-in-Splunk-getting-column-names-along-with/m-p/579847#M13352 ITWhisperer 2022-01-04T09:18:06Z