topic email Alert with table values in Dashboards & Visualizations

topic email Alert with table values in Dashboards & Visualizations https://community.splunk.com/t5/Dashboards-Visualizations/email-Alert-with-table-values/m-p/536444#M36619 <P> </P><P>Sending email alert when the error count > 0 results;  but how can include table data/values in the email alert? </P><P>( table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details )</P><P>Query: </P><P>index=gbs_its_openshift_exp-ics2 openshift_container_name="regulatory-engine" "ER1/ER9 errors"<BR />| rex field=_raw "uref:(?<UREF>\w+)"<BR />| rex field=_raw "hawb:(?<HAWB>\w+)"<BR />| rex field=_raw "lrn:(?<LRN>\w+)"<BR />| rex field=_raw "mrn:(?<MRN>\w+)"<BR />| rex field=_raw "rrr:(?<RRR>\w+)"<BR />| rex field=_raw "ER1\/ER9\serrors:(?<ER1_ER9_Details>.+)"<BR />| rex field=_raw "Err-\[(?<ERROR_CD>\w*)\]"<BR />| table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details<BR />| stats count<BR />| search count > 0</P> Wed, 20 Jan 2021 07:54:59 GMT 4uramana4u 2021-01-20T07:54:59Z email Alert with table values https://community.splunk.com/t5/Dashboards-Visualizations/email-Alert-with-table-values/m-p/536444#M36619 <P> </P><P>Sending email alert when the error count > 0 results;  but how can include table data/values in the email alert? </P><P>( table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details )</P><P>Query: </P><P>index=gbs_its_openshift_exp-ics2 openshift_container_name="regulatory-engine" "ER1/ER9 errors"<BR />| rex field=_raw "uref:(?<UREF>\w+)"<BR />| rex field=_raw "hawb:(?<HAWB>\w+)"<BR />| rex field=_raw "lrn:(?<LRN>\w+)"<BR />| rex field=_raw "mrn:(?<MRN>\w+)"<BR />| rex field=_raw "rrr:(?<RRR>\w+)"<BR />| rex field=_raw "ER1\/ER9\serrors:(?<ER1_ER9_Details>.+)"<BR />| rex field=_raw "Err-\[(?<ERROR_CD>\w*)\]"<BR />| table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details<BR />| stats count<BR />| search count > 0</P> Wed, 20 Jan 2021 07:54:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/email-Alert-with-table-values/m-p/536444#M36619 4uramana4u 2021-01-20T07:54:59Z Re: email Alert with table values https://community.splunk.com/t5/Dashboards-Visualizations/email-Alert-with-table-values/m-p/536449#M36620 <P>This is working!!</P><P>| stats count as ERROR_CNT by ERROR_CD, UREF, HAWB, LRN, MRN, ER1_ER9_Details | where ERROR_CNT>0</P> Wed, 20 Jan 2021 08:45:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/email-Alert-with-table-values/m-p/536449#M36620 4uramana4u 2021-01-20T08:45:16Z