Alerting

Column Order in Email Alerts

enielson
Explorer

Column order (in HTML table output format) in email alerts seems to be decided by splunk, ignoring the order in the "fields" command.

Is it possible to specify which order they are in?

Tags (2)
0 Karma
2 Solutions

the_wolverine
Champion

Which version are you reporting this for?

CSV columns should work properly but html column sort is broken. It will be fixed in 4.1.4.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The order is in order of length of the longest field value per field. It is not configurable other than by editing the $SPLUNK_HOME/etc/apps/search/sendemail.py script. (In 4.1.3 and prior.)

View solution in original post

assaftoval
New Member

The suggested addition 'width_sort_columns = 0' is not working.
I'm using 4.3.2 and verified format = text, still no good.

Any other ideas?

0 Karma

Masa
Splunk Employee
Splunk Employee

Good news!
In 4.3, we added an attribute in alert_actions.conf to keep order of fields.
Please check a spec file, alert_actions.conf.spec


[email]
width_sort_columns =
* Whether columns should be sorted from least wide to most wide left to right.
* Valid only if format=text
* Defaults to true

So, if you add this attribute to alert_actions.conf ( generally found in etc/system/local )

[email]
width_sort_columns = 0

We cannot select this option through WebGUI.

gkanapathy
Splunk Employee
Splunk Employee

The order is in order of length of the longest field value per field. It is not configurable other than by editing the $SPLUNK_HOME/etc/apps/search/sendemail.py script. (In 4.1.3 and prior.)

View solution in original post

the_wolverine
Champion

Which version are you reporting this for?

CSV columns should work properly but html column sort is broken. It will be fixed in 4.1.4.

View solution in original post

enielson
Explorer

Thanks for the info.

I am using 4.1.2.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!