I am sending a table in mail as an alert but I want to hide some fields of the table. But after hiding with fields - I am not able to access those fields in mail body with $result.field_name$

Path Finder

It is a daily report I am sending as scheduled alert. Alert query displaying table in mail body bur I want to remove few fields, but if removed I ma unable to access them with $result.field_name$. Please suggest some alternative.

Labels (1)
Tags (1)
0 Karma


What worked for me was a combination of the tips described by others here:

1) For use in token in email header or body, create a version of the field you want with an underscore as a prefix (e.g., | eval _fieldA = fieldA). You will use this field in the token -- e.g., $result._fieldA$.
2) Use 'fields' command instead of 'table' command. (I thought I had to use 'table' command to order the fields as I wanted in the email output. But 'fields' seems to work for that purpose as well.) Be sure to include the underscore-prefixed version of the field you want (e.g., "_fieldA") to use as token. (I just put it at the end.) Because it is prefixed with underscore, it won't show up in email table output.

That's it. Worked for me.


You can try to rename those fields, so they start with an _.
Fields starting with an _ still exist, but are invisible - so you shouldn't see them, but they should be available to you.

Try | rename yourfield as _yourfield.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂


Hi @xpac , I am sending the alert mail using "Sendresult Splunk App" and this solution is not working there.

Can you help me with some other solution?

0 Karma


Hi @xpac ,

It works perfectly well for me

Thanks ! 😊

0 Karma

Path Finder

After renaming as _fieldname the field in not coming in table output but still I am not able to use that field in E-mail body.
My alert is sending one table in mail which have has 10 desired fields and 3 more fields which has only one value and I dont want to show those 3 in table o/p.

I want to use those 3 in alert like this:
Percentage of Loss Assigned in Shift-A :- $result.PerAssigned_A$ %
Percentage of Loss Assigned in Shift-B :- $result.PerAssigned_B$ %
Percentage of Loss Assigned in Shift-C :- $result.PerAssigned_C$ %

So they appear in mail body like:
Percentage of Loss Assigned in Shift-A :- 60%
Percentage of Loss Assigned in Shift-B :- 75 %
Percentage of Loss Assigned in Shift-C :- 30 %

They are coming in mail properly but also coming in table o/p.

0 Karma


Did you solve this? I'm wanting this too.

I've been trying different things with the attribute in the 'advanced edit' screen for the alert, but I've not yet found a solution.

0 Karma


As you've discovered, the fields - command does not hide fields, it removes them. Removed fields are not available to later commands.

Please describe what you want the end result to be and we may be able to suggestion some options.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...