Alerting
Highlighted

How can I keep order of fields in plain format of an alert email?

Splunk Employee
Splunk Employee

In email alert as plain text format, the order of fields of a search result is not kept. It is rearranged to keep shorter field first.

For example,


==> SavedSearch Result
TIME COUNT

2012/02/10 09:05:00 163

2012/02/10 09:06:00 1810

2012/02/10 09:07:00 1115

2012/02/10 09:08:00 1240

2012/02/10 09:09:00 672

==> Same search result sent in Email alert (Plain Text)
COUNT TIME

163 2012/02/10 09:05:00

1810 2012/02/10 09:06:00

1115 2012/02/10 09:07:00

1240 2012/02/10 09:08:00

672 2012/02/10 09:09:00


How can I keep the fields order of the search result in plain text email alert?

Tags (2)
0 Karma
Highlighted

Re: How can I keep order of fields in plain format of an alert email?

Splunk Employee
Splunk Employee

In 4.3, we added an attribute for [email] stanza in alert_actions.conf

- alert_actions.conf
[email]
width_sort_columns = 0

This will keep the order of search result in plain text email.

Unfortunately you cannot select this option through WebGUI at this time. So, you need to edit alert_actions.conf manually.

Highlighted

Re: How can I keep order of fields in plain format of an alert email?

Communicator

It is now available in the gui, under "advanced edit" for the alert.

0 Karma
Highlighted

Re: How can I keep order of fields in plain format of an alert email?

Esteemed Legend

It is reordering them based on alphabetical order. To keep the order, add this to the bottom:

| rename TIME AS " TIME"
0 Karma
Highlighted

Re: How can I keep order of fields in plain format of an alert email?

Communicator

That was not my experience. It was sorting them as the documentation indicates -- by an internal assessment of the length (or width) of fields. You can now set that setting -- widthsortcolumns -- to "false" in the GUI.

0 Karma
Highlighted

Re: How can I keep order of fields in plain format of an alert email?

Esteemed Legend

Interesting.

0 Karma