adjust the content with csv file in alert email - Splunk Community

Alerting

i defined an alert to send email to me , but i found the attachment ( .csv file ) in the alert mail is incomplete, it miss some importance column,

i wonder how to alter the content in the csv file ?

Fix your search. The CSV is based off the fields in your search. There is nothing that removes fields once the search is complete.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...