topic Re: Plain Text Email options in Alerting

Plain Text Email options

diegosainz — Thu, 15 Nov 2012 17:44:44 GMT

I would like to modify the plain text email option to remove the _raw and the dashes from the top of the email. Is there a simple way to make that modification?

Re: Plain Text Email options

itinney — Thu, 15 Nov 2012 18:38:01 GMT

The inclusion of the _raw field is down to the search itself, so you can have it excluded by using the fields command, i.e.

sourcetype=blah | fields - _raw

or to exclude all hidden fields

sourcetype=blah | fields - _*

If you really only need specific fields, then use the table command to specify which fields you want displayed,
i.e.

sourcetype=blah | table source, sourcetype, host, index

The dashes at the top underline the header row, do you not want any column headings? Without the _raw field you will only have a table of fields and the header row is surely useful?

Re: Plain Text Email options

diegosainz — Thu, 15 Nov 2012 19:31:08 GMT

Thanks for the quick response. I am looking to have the email sent to an automated ticketing system and would like just the field data in there. I have removed all but the _raw field and do not have a table in the plain test. The dashes themselves are more cosmetic for removal.

Re: Plain Text Email options

itinney — Thu, 15 Nov 2012 20:37:30 GMT

It might help to include your search, but I would guess that the search just needs to have the following added to the end of it:
... | fields - _raw