Reporting

Hide table column in inline email table

jamesdsteel
Explorer

Hi,

I'm looking for a way to hide a table column in an inline email table while still retaining the ability to use the hidden column in the email notification tokens.

I want to use the token $result.recipients$ in my "To" field for the email notification, but don't want to display the recipients column in the inline table I'm sending in the email.

Is there a way to remove the column while still being able to use the token? I've tried both table and fields commands to display only the columns I want, but they both completely remove the recipients field from the results so it can't be used in the token..

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

peterchenadded
Path Finder

Looks like if you have fields starting with _ they won't be displayed in the inline table. Tested in splunk 7.3.4

e.g.

| makeresults
| eval _hidden_field="hidden_field"
| eval test="hello world"

The inline table will show:

1. _time

2. test

And you can use $result._hidden_field$ in the to field/subject/message field

View solution in original post

peterchenadded
Path Finder

Looks like if you have fields starting with _ they won't be displayed in the inline table. Tested in splunk 7.3.4

e.g.

| makeresults
| eval _hidden_field="hidden_field"
| eval test="hello world"

The inline table will show:

1. _time

2. test

And you can use $result._hidden_field$ in the to field/subject/message field

jamesdsteel
Explorer

Thanks! Tested and this works a treat.

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...