topic Hide table column in inline email table in Reporting

Hide table column in inline email table

jamesdsteel — Wed, 08 Jul 2020 10:31:45 GMT

Hi,

I'm looking for a way to hide a table column in an inline email table while still retaining the ability to use the hidden column in the email notification tokens.

I want to use the token $result.recipients$ in my "To" field for the email notification, but don't want to display the recipients column in the inline table I'm sending in the email.

Is there a way to remove the column while still being able to use the token? I've tried both table and fields commands to display only the columns I want, but they both completely remove the recipients field from the results so it can't be used in the token..

Thanks

Re: Hide table column in inline email table

peterchenadded — Mon, 26 Oct 2020 06:24:24 GMT

Looks like if you have fields starting with _ they won't be displayed in the inline table. Tested in splunk 7.3.4

e.g.

| makeresults
| eval _hidden_field="hidden_field"
| eval test="hello world"

The inline table will show:

1. _time

2. test

And you can use $result._hidden_field$ in the to field/subject/message field

Re: Hide table column in inline email table

jamesdsteel — Mon, 26 Oct 2020 09:55:06 GMT

Thanks! Tested and this works a treat.