I use the following in the Alert Search to get the Email Message (body) in the Splunk Results output:
| eval Alert_Message= "Text A, Text B, Text C"
| table Alert_Message ...
It shows the Message in the Splunk Results output in 'One single line' > Text A, Text B, Text C
Is it possible to get the Splunk Results output, e.g. in 3 Lines?
I actually solved it myself, by adding a star after each line, and using | makemv delim="*" Alert_Message
You can also use the mvexpand command here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Mvexpand. You should post/accept an answer or close the question to mark it as resolved!