Email from Splunk

[viksvig]

I have splunk search - index=cloud EventName: "Error Occurred" XChangeToSalesForce | rename message as "Message" _time as Time | table Time,Message

When i search on splunk search, i get the below response

1637759064  Multiple Terms found for the same agency. Agency code: 

But when the email is sent, i get nothing on the message field

Time	Message
1637759064

[johnhuang]

How is the email formatted? Are you inserting the results as an inline table?

[Siddharth]

Try to add the results in some log or lookup and check the output 

In case if it is empty check the data and if not try to send the alert to your mail id using  this 

| makeresults | eval a = temp | table  a _time

and use inline table in your alert 

[viksvig]

@johnhuang  it is formatted as inline table, i tried inline raw as well

[viksvig]

@johnhuang  any idea why it is skipping the Messages

[johnhuang]

Could you post a sample of the search result and also the email template config.

[viksvig]

This is the search and I am getting the desired result here. But when Email is sent the Message field blanks out

[viksvig]

[johnhuang]

That's strange and interesting. Lets rule out a few things.

1. Could you enable the options "Attach CSV" and "Attach PDF"? Run another test and see if the data is in the attachments.

2. Let's replace the data in Message with safe characters and see if that works.

| eval message="testing_"._time