topic Re: How to select fields for email alert in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13029#M1128 <P>This is exactly what I was looking for. Thank you</P> Fri, 07 May 2010 21:30:41 GMT Jaci 2010-05-07T21:30:41Z How to select fields for email alert https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13026#M1125 <P>Is there any way to control the reported fields in an email alert? I have configured splunk to add the search results inline, but I don't need all the fields it is showing. I only want the host and _raw fields to show up in the email. Can you point me in the direction where I can change this behavior?</P> Thu, 06 May 2010 22:13:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13026#M1125 Jaci 2010-05-06T22:13:10Z Re: How to select fields for email alert https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13027#M1126 <P>You can control this by appending "| fields + host,_raw" to the search string</P> Thu, 06 May 2010 22:59:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13027#M1126 Dan 2010-05-06T22:59:47Z Re: How to select fields for email alert https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13028#M1127 <P>If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.</P> Fri, 07 May 2010 13:53:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13028#M1127 CerielTjuh 2010-05-07T13:53:00Z Re: How to select fields for email alert https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13029#M1128 <P>This is exactly what I was looking for. Thank you</P> Fri, 07 May 2010 21:30:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13029#M1128 Jaci 2010-05-07T21:30:41Z Re: How to select fields for email alert https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13030#M1129 <P>Thank you for the answer, this is helpful.</P> Fri, 07 May 2010 21:31:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-select-fields-for-email-alert/m-p/13030#M1129 Jaci 2010-05-07T21:31:14Z