Alerting

Alert report - columns not ordered by table command

brdr
Contributor

Hello,

Is there a way to guarantee the columns order in which they are defined by the last command (table) in the search that generates the report/alert? NOTE: I'm formatting the results using inline table.

As always, thank you.

Azeemering
Builder

The table command returns a table that is formed by only the fields that you specify in the arguments. Columns are displayed in the same order that fields are specified. Column headers are the field names. Rows are the field values. Each row represents an event.

Example SPL:

Index=farmanimals | table cows, chickens, pigs it will display the table also in that order.
Is it not the case with your query?

0 Karma

AllenZhang
Explorer

In my case,

index=example | table SID Auto Manual Total

Everything looks fine on web. However in email as inline, it shows:

Auto Total SID Manual

0 Karma

AllenZhang
Explorer

I just noticed the same issue.

it's fine as search result.

But not in the same order in the email as inline table  received by scheduled report.

 

0 Karma

brdr
Contributor

No it is not. In my search that makes up the alert I have this as the last line:

| table 1 2 3 4 5 6 7

The inline table results I receive via email has them in this order:

7 1 2 3 5 4 6

0 Karma

n0vsec
Explorer

Were you able to resolve this?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...