Alerting

I am sending a table in mail as an alert but I want to hide some fields of the table. But after hiding with fields - I am not able to access those fields in mail body with $result.field_name$

jitendragupta
Path Finder

It is a daily report I am sending as scheduled alert. Alert query displaying table in mail body bur I want to remove few fields, but if removed I ma unable to access them with $result.field_name$. Please suggest some alternative.

Labels (1)
Tags (1)
0 Karma

wryanthomas
Communicator

What worked for me was a combination of the tips described by others here:

1) For use in token in email header or body, create a version of the field you want with an underscore as a prefix (e.g., | eval _fieldA = fieldA). You will use this field in the token -- e.g., $result._fieldA$.
2) Use 'fields' command instead of 'table' command. (I thought I had to use 'table' command to order the fields as I wanted in the email output. But 'fields' seems to work for that purpose as well.) Be sure to include the underscore-prefixed version of the field you want (e.g., "_fieldA") to use as token. (I just put it at the end.) Because it is prefixed with underscore, it won't show up in email table output.

That's it. Worked for me.

0 Karma

xpac
SplunkTrust
SplunkTrust

You can try to rename those fields, so they start with an _.
Fields starting with an _ still exist, but are invisible - so you shouldn't see them, but they should be available to you.

Try | rename yourfield as _yourfield.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Utkarsh_
Explorer

Hi @xpac , I am sending the alert mail using "Sendresult Splunk App" and this solution is not working there.

Can you help me with some other solution?

0 Karma

hkngns
Engager

Hi @xpac ,

It works perfectly well for me

Thanks ! 😊

0 Karma

jitendragupta
Path Finder

After renaming as _fieldname the field in not coming in table output but still I am not able to use that field in E-mail body.
My alert is sending one table in mail which have has 10 desired fields and 3 more fields which has only one value and I dont want to show those 3 in table o/p.

I want to use those 3 in alert like this:
Percentage of Loss Assigned in Shift-A :- $result.PerAssigned_A$ %
Percentage of Loss Assigned in Shift-B :- $result.PerAssigned_B$ %
Percentage of Loss Assigned in Shift-C :- $result.PerAssigned_C$ %

So they appear in mail body like:
Percentage of Loss Assigned in Shift-A :- 60%
Percentage of Loss Assigned in Shift-B :- 75 %
Percentage of Loss Assigned in Shift-C :- 30 %

They are coming in mail properly but also coming in table o/p.

https://drive.google.com/open?id=1BTy7Af2wwYvhMs_q59UW35Eqz_TkhoYZ

0 Karma

wryanthomas
Communicator

Did you solve this? I'm wanting this too.

I've been trying different things with the action.email.preprocess_results attribute in the 'advanced edit' screen for the alert, but I've not yet found a solution.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As you've discovered, the fields - command does not hide fields, it removes them. Removed fields are not available to later commands.

Please describe what you want the end result to be and we may be able to suggestion some options.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...