Splunk Search

How to edit the table format in my email alert so that each item starts a new line?

omuelle1
Communicator

Hi Splunkers and Happy Friday

I am trying to put together an email that looks something like this:

alt text

However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:

alt text

The underlying search is this:

| fields - _raw, _time 
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS)  list(PACKQTY)  list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO 
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"

Would anybody know how to get this to have any value in the their own row and not right after each other?

Thank you very much guys,

Oliver

Tags (4)
1 Solution

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

View solution in original post

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

omuelle1
Communicator

I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.

0 Karma

ckunath
Communicator

Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...