Alerting

Plain Text Email options

diegosainz
Path Finder

I would like to modify the plain text email option to remove the _raw and the dashes from the top of the email. Is there a simple way to make that modification?

Tags (3)
0 Karma

itinney
Path Finder

The inclusion of the _raw field is down to the search itself, so you can have it excluded by using the fields command, i.e.

sourcetype=blah | fields - _raw

or to exclude all hidden fields

sourcetype=blah | fields - _*

If you really only need specific fields, then use the table command to specify which fields you want displayed,
i.e.

sourcetype=blah | table source, sourcetype, host, index

The dashes at the top underline the header row, do you not want any column headings? Without the _raw field you will only have a table of fields and the header row is surely useful?

itinney
Path Finder

It might help to include your search, but I would guess that the search just needs to have the following added to the end of it:
... | fields - _raw

diegosainz
Path Finder

Thanks for the quick response. I am looking to have the email sent to an automated ticketing system and would like just the field data in there. I have removed all but the _raw field and do not have a table in the plain test. The dashes themselves are more cosmetic for removal.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!