Other Usage

How to hide a column in the email

manojchacko78
Path Finder

Hello

I have created an email alert and the recipients are pulled from the search results.  Below is the part of the search query

| stats count by CreateTimestamp  CCRecipients
| rename CCRecipients as Recipients
| table CreateTimestamp Recipients
| fields - count

and in the email alert configuration i added this $result.Recipients$ under the CC field

Now without having Recipients in the search results, i cannot parse it in the CC field.

So now when the mail gets triggered, the values in Recipients are getting displayed as part of the table, now do i mask this from appearing in the email?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats count by CreateTimestamp  CCRecipients
| rename CCRecipients as _Recipients
| fields - count

Then add this $result._Recipients$ under the CC field

View solution in original post

manojchacko78
Path Finder

The issue is resolved, thanks a lot.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats count by CreateTimestamp  CCRecipients
| rename CCRecipients as _Recipients
| fields - count

Then add this $result._Recipients$ under the CC field

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...