Alerting

Column Order in Email Alerts

Explorer

Column order (in HTML table output format) in email alerts seems to be decided by splunk, ignoring the order in the "fields" command.

Is it possible to specify which order they are in?

Tags (2)
0 Karma
2 Solutions

Champion

Which version are you reporting this for?

CSV columns should work properly but html column sort is broken. It will be fixed in 4.1.4.

View solution in original post

Splunk Employee
Splunk Employee

The order is in order of length of the longest field value per field. It is not configurable other than by editing the $SPLUNK_HOME/etc/apps/search/sendemail.py script. (In 4.1.3 and prior.)

View solution in original post

New Member

The suggested addition 'widthsortcolumns = 0' is not working.
I'm using 4.3.2 and verified format = text, still no good.

Any other ideas?

0 Karma

Splunk Employee
Splunk Employee

Good news!
In 4.3, we added an attribute in alertactions.conf to keep order of fields.
Please check a spec file, alert
actions.conf.spec


[email]
widthsortcolumns =
* Whether columns should be sorted from least wide to most wide left to right.
* Valid only if format=text
* Defaults to true

So, if you add this attribute to alert_actions.conf ( generally found in etc/system/local )

[email]
widthsortcolumns = 0

We cannot select this option through WebGUI.

Splunk Employee
Splunk Employee

The order is in order of length of the longest field value per field. It is not configurable other than by editing the $SPLUNK_HOME/etc/apps/search/sendemail.py script. (In 4.1.3 and prior.)

View solution in original post

Champion

Which version are you reporting this for?

CSV columns should work properly but html column sort is broken. It will be fixed in 4.1.4.

View solution in original post

Explorer

Thanks for the info.

I am using 4.1.2.

0 Karma