I have set up a couple of alerts and have chosen an inline table in the subsequent email. The contents of that table, however, seem almost totally random. Does anyone know where those fields come from and how they can be changed? I can see a display.events.fields setting in savedsearches, but I don't know if this has any bearing on it nor where the current fields in there came from. If I change them, it doesn't affect the content of the alert email.
The search is simply looking for values over a particular numeric threshold:
OK great thanks that works. I had a table command in it previously and the whole alert wouldn't work but that must have been to do with some fields I had in the root search. This solution works and I can add what I need, thanks.