topic Re: How to include only certain fields in an email sent from an alert in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332789#M175307 <P>Be sure to click <CODE>Accept</CODE> to close the question.</P> Wed, 01 Mar 2017 19:53:38 GMT woodcock 2017-03-01T19:53:38Z How to include only certain fields in an email sent from an alert https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332786#M175304 <P>I have an alert that looks for a pattern in an event that is an xml: ie.</P> <P>":2017-03-01 06:02:16,194 INFO 7010 System Error 7025 Failed Request Build null null"</P> <P>I want to send the email that includes only the TransactionStatusMessageDetail field, but I get the _raw sent<BR /> (Failed Request Build) is the field<BR /> Can this be done? Splunk Enterprise version is 6.1</P> Wed, 01 Mar 2017 19:06:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332786#M175304 riotto 2017-03-01T19:06:50Z Re: How to include only certain fields in an email sent from an alert https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332787#M175305 <P>Just add <CODE>| table TransactionStatusMessageDetail</CODE> as the last part of your search.</P> Wed, 01 Mar 2017 19:11:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332787#M175305 woodcock 2017-03-01T19:11:30Z Re: How to include only certain fields in an email sent from an alert https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332788#M175306 <P>Works like a champ!...thanks</P> Wed, 01 Mar 2017 19:30:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332788#M175306 riotto 2017-03-01T19:30:14Z Re: How to include only certain fields in an email sent from an alert https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332789#M175307 <P>Be sure to click <CODE>Accept</CODE> to close the question.</P> Wed, 01 Mar 2017 19:53:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-include-only-certain-fields-in-an-email-sent-from-an/m-p/332789#M175307 woodcock 2017-03-01T19:53:38Z