Hi @sphiwee
I think the issue is that your current SPL concatenates all your data into a single field (`report`) separated by a line breaks, although its not clear how that line break is interpreted by Teams.
I have previously had success with Microsoft Teams using Markdown or specific JSON structures (like Adaptive Cards) for rich formatting like tables, especially via webhooks. Simple text won't be interpreted as a table. Technically speaking Teams webhook messages dont support Markdown, and HTML is encoded and treated as text.
You can try modifying your SPL to generate a Markdown formatted table directly within the search results. This *might* render correctly in Teams depending on how the alert action sends the payload.
Remove your last three lines (`eval row = ...`, `stats values(row) AS report`, `eval report = mvjoin(...)`).
Add formatting logic after the `foreach` loops.
index="acoe_bot_events"
unique_id = *
| lookup "LU_ACOE_RDA_Tracker" ID AS unique_id
| search Business_Area_Level_2="Client Solutions Insurance" , Category="*", Business_Unit = "*", Analyst_Responsible = "*", Process_Name = "*"
| eval STP=(passed/heartbeat)*100
| eval Hours=(passed*Standard_Working_Time)/60
| eval FTE=(Hours/127.5)
| eval Benefit=(passed*Standard_Working_Time*Benefit_Per_Minute)
| stats sum(heartbeat) as Volumes sum(passed) as Successful avg(STP) as Average_STP,sum(FTE) as FTE_Saved, sum(Hours) as Hours_Saved, sum(Benefit) as Rand_Benefit by Process_Name, Business_Unit, Analyst_Responsible
| foreach * [eval FTE_Saved=round('FTE_Saved',3)]
| foreach * [eval Hours_Saved=round('Hours_Saved',3)]
| foreach * [eval Rand_Benefit=round('Rand_Benefit',2)]
| foreach * [eval Average_STP=round('Average_STP',2)]
```--- Start Markdown Formatting ---```
| fillnull value="N/A" Process_Name Business_Unit Analyst_Responsible Volumes Successful Average_STP FTE_Saved Hours_Saved Rand_Benefit
``` Format each row as a Markdown table row ```
| eval markdown_row = "| " . Process_Name . " | " . Business_Unit . " | " . Analyst_Responsible . " | " . Volumes . " | " . Successful . " | " . Average_STP . "% | " . FTE_Saved . " | " . Hours_Saved . " | " . Rand_Benefit . " |"
``` Combine all rows into a single multivalue field ```
| stats values(markdown_row) as table_rows
``` Create the final Markdown table string ```
| eval markdown_table = "| Process Name | Business Unit | Analyst | Volumes | Successful | Avg STP | FTE Saved | Hours Saved | Rand Benefit |\n" . "|---|---|---|---|---|---|---|---|---|\n" . mvjoin(table_rows, "\n")
``` Select only the final field to be potentially used by the alert action ```
| fields markdown_table In the alert action configuration, you'll need to reference the result field containing the Markdown. Often, you can use tokens like `$result.markdown_table$`
Considerations for Markdown Approach:
- Character Limits: Teams messages and webhook payloads have character limits. Very large tables might get truncated.
- Rendering: Teams Markdown rendering for tables can sometimes be basic and may is not supported.
- Alert Action App: Success depends heavily on *how* your Teams alert action sends the payload. Some might wrap it in JSON, others might send raw text. You might need to experiment.
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
