Alerting

Wrong order in the table generated in email of a saved search?

feniix
New Member

I have saved the following search that generates a table and set it up to send me an email with the results.

The query is the following one: Query Terms: 'blabla "Instance=blabla" | eval Date=_time | convert timeformat="%Y%m%d-%H:%M" ctime(Date) | eval Filename=Artifact | eval LastModification=LastMod | table Date Host Instance Filename LastModification Size'

In the web search it shows the order specified but the email shows something similar to this:

Instance    Size        Host            Date           LastModification   Filename
----------------------------------------------------------------------------------------------------------------
blabla    42901066      host1         20100715-19:44    20100614-14:55    20100614-WLS-2.8.3.14-r16780.war

What I am doing wrong?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I think this is considered a bug to be fixed.

View solution in original post

southeringtonp
Motivator

If it annoys you enough, you can make your own version of apps/search/bin/sendemail.py and replace/extend the getSortedColumns() function.

You still have to have a way to figure out what the correct column order actually is -- alphabetical is easy, or for emails based on saved searches you can look at the search string for commands like fields and infer the correct order from that.

Of course, that means you now have to maintain it, since Splunk upgrades may introduce new changes to the script.

0 Karma

community
New Member

Several days ago I was at the I-net and observed there an unusual software - recover outlook express password. It surprised me reason of the tool could solve my old troubles with email account and outlook express account too as I kept in mind. Possible this tool will relieve you...

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You are doing nothing wrong. The email script in the current version lists columns in the order of the maximum length of the field values in each column. I think this is considered a bug to be fixed.

feniix
New Member

Thanks for the response. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...