How to edit the table format in my email alert so that each item starts a new line?

[omuelle1]

Hi Splunkers and Happy Friday

I am trying to put together an email that looks something like this:

However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:

The underlying search is this:

| fields - _raw, _time 
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS)  list(PACKQTY)  list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO 
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"

Would anybody know how to get this to have any value in the their own row and not right after each other?

Thank you very much guys,

Oliver

[omuelle1 · Accepted solution]

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

[omuelle1]

I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.

[ckunath]

Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand