Alerting

Wrong order in the table generated in email of a saved search?

feniix
New Member

I have saved the following search that generates a table and set it up to send me an email with the results.

The query is the following one: Query Terms: 'blabla "Instance=blabla" | eval Date=_time | convert timeformat="%Y%m%d-%H:%M" ctime(Date) | eval Filename=Artifact | eval LastModification=LastMod | table Date Host Instance Filename LastModification Size'

In the web search it shows the order specified but the email shows something similar to this:

Instance    Size        Host            Date           LastModification   Filename
----------------------------------------------------------------------------------------------------------------
blabla    42901066      host1         20100715-19:44    20100614-14:55    20100614-WLS-2.8.3.14-r16780.war

What I am doing wrong?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I think this is considered a bug to be fixed.

View solution in original post

southeringtonp
Motivator

If it annoys you enough, you can make your own version of apps/search/bin/sendemail.py and replace/extend the getSortedColumns() function.

You still have to have a way to figure out what the correct column order actually is -- alphabetical is easy, or for emails based on saved searches you can look at the search string for commands like fields and infer the correct order from that.

Of course, that means you now have to maintain it, since Splunk upgrades may introduce new changes to the script.

0 Karma

community
New Member

Several days ago I was at the I-net and observed there an unusual software - recover outlook express password. It surprised me reason of the tool could solve my old troubles with email account and outlook express account too as I kept in mind. Possible this tool will relieve you...

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I think this is considered a bug to be fixed.

feniix
New Member

Thanks for the response. 🙂

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...