Alerting

How can I keep order of fields in plain format of an alert email?

Masa
Splunk Employee
Splunk Employee

In email alert as plain text format, the order of fields of a search result is not kept. It is rearranged to keep shorter field first.

For example,


==> SavedSearch Result
TIME COUNT

2012/02/10 09:05:00 163

2012/02/10 09:06:00 1810

2012/02/10 09:07:00 1115

2012/02/10 09:08:00 1240

2012/02/10 09:09:00 672

==> Same search result sent in Email alert (Plain Text)
COUNT TIME

163 2012/02/10 09:05:00

1810 2012/02/10 09:06:00

1115 2012/02/10 09:07:00

1240 2012/02/10 09:08:00

672 2012/02/10 09:09:00


How can I keep the fields order of the search result in plain text email alert?

Tags (2)
0 Karma

woodcock
Esteemed Legend

It is reordering them based on alphabetical order. To keep the order, add this to the bottom:

| rename TIME AS " TIME"
0 Karma

wryanthomas
Contributor

That was not my experience. It was sorting them as the documentation indicates -- by an internal assessment of the length (or width) of fields. You can now set that setting -- width_sort_columns -- to "false" in the GUI.

0 Karma

woodcock
Esteemed Legend

Interesting.

0 Karma

Masa
Splunk Employee
Splunk Employee

In 4.3, we added an attribute for [email] stanza in alert_actions.conf

- alert_actions.conf
[email]
width_sort_columns = 0

This will keep the order of search result in plain text email.

Unfortunately you cannot select this option through WebGUI at this time. So, you need to edit alert_actions.conf manually.

wryanthomas
Contributor

It is now available in the gui, under "advanced edit" for the alert.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...