Hide table column in inline email table

[jamesdsteel]

Hi,

I'm looking for a way to hide a table column in an inline email table while still retaining the ability to use the hidden column in the email notification tokens.

I want to use the token $result.recipients$ in my "To" field for the email notification, but don't want to display the recipients column in the inline table I'm sending in the email.

Is there a way to remove the column while still being able to use the token? I've tried both table and fields commands to display only the columns I want, but they both completely remove the recipients field from the results so it can't be used in the token..

Thanks

[peterchenadded · Accepted solution]

Looks like if you have fields starting with _ they won't be displayed in the inline table. Tested in splunk 7.3.4

e.g.

| makeresults
| eval _hidden_field="hidden_field"
| eval test="hello world"

The inline table will show:

1. _time

2. test

And you can use $result._hidden_field$ in the to field/subject/message field

[jamesdsteel]

Thanks! Tested and this works a treat.