topic Re: Column Order in Email Alerts in Alerting

Column Order in Email Alerts

enielson — Wed, 23 Jun 2010 03:35:00 GMT

Column order (in HTML table output format) in email alerts seems to be decided by splunk, ignoring the order in the "fields" command.

Is it possible to specify which order they are in?

Re: Column Order in Email Alerts

the_wolverine — Wed, 23 Jun 2010 04:04:14 GMT

Which version are you reporting this for?

CSV columns should work properly but html column sort is broken. It will be fixed in 4.1.4.

Re: Column Order in Email Alerts

enielson — Wed, 23 Jun 2010 04:16:00 GMT

Thanks for the info.

I am using 4.1.2.

Re: Column Order in Email Alerts

gkanapathy — Wed, 23 Jun 2010 05:29:04 GMT

The order is in order of length of the longest field value per field. It is not configurable other than by editing the $SPLUNK_HOME/etc/apps/search/sendemail.py script. (In 4.1.3 and prior.)

Re: Column Order in Email Alerts

Masa — Mon, 28 Sep 2020 11:23:07 GMT

Good news!
In 4.3, we added an attribute in alert_actions.conf to keep order of fields.
Please check a spec file, alert_actions.conf.spec



[email]

width_sort_columns = 

    * Whether columns should be sorted from least wide to most wide left to right.

    * Valid only if format=text

    * Defaults to true

So, if you add this attribute to alert_actions.conf ( generally found in etc/system/local )

[email]
width_sort_columns = 0

We cannot select this option through WebGUI.

Re: Column Order in Email Alerts

assaftoval — Mon, 28 Sep 2020 12:15:48 GMT

The suggested addition 'width_sort_columns = 0' is not working.
I'm using 4.3.2 and verified format = text, still no good.

Any other ideas?