topic Re: Why is there a null field appended to a username in my Alerts. in Alerting https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464087#M8248 <P>As richgalloway stated: "Splunk's PDF generator has its quirks. Consider putting the results inline instead of as an attachment (or both)." <BR /> he recommended using the inline result</P> Fri, 22 May 2020 22:17:27 GMT splunktrainingu 2020-05-22T22:17:27Z Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464082#M8243 <P>This is my search query for my alert.</P> <P>index=test EventCode=4625 | eval Account_Name=mvindex(Account_Name, -1) | search NOT Account_Name="BENQ$" NOT Account_Name="-" | stats count by Account_Name <BR /> | where count &gt;= 2</P> <P>So the alert will trigger if a person fails to login 2 times or more. The PDF shows a the username (johnsmithnull) but when opening it in the table it shows johnsmith and the count of how many times. Is Johnsmithnull a title the gets appended by splunk? </P> Wed, 30 Sep 2020 05:33:14 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464082#M8243 splunktrainingu 2020-09-30T05:33:14Z Re: Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464083#M8244 <P>Splunk's PDF generator has its quirks. Consider putting the results inline instead of as an attachment (or both).</P> Fri, 22 May 2020 19:06:37 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464083#M8244 richgalloway 2020-05-22T19:06:37Z Re: Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464084#M8245 <P>I am going to run some tests then. But what is different about inline vs PDF?</P> Fri, 22 May 2020 19:24:03 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464084#M8245 splunktrainingu 2020-05-22T19:24:03Z Re: Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464085#M8246 <P>Putting the results inline means recipients see the data in the body of the email, unadulterated by the PDf generator.</P> Fri, 22 May 2020 20:02:30 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464085#M8246 richgalloway 2020-05-22T20:02:30Z Re: Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464086#M8247 <P>Thank you!</P> Fri, 22 May 2020 20:30:29 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464086#M8247 splunktrainingu 2020-05-22T20:30:29Z Re: Why is there a null field appended to a username in my Alerts. https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464087#M8248 <P>As richgalloway stated: "Splunk's PDF generator has its quirks. Consider putting the results inline instead of as an attachment (or both)." <BR /> he recommended using the inline result</P> Fri, 22 May 2020 22:17:27 GMT https://community.splunk.com/t5/Alerting/Why-is-there-a-null-field-appended-to-a-username-in-my-Alerts/m-p/464087#M8248 splunktrainingu 2020-05-22T22:17:27Z