Splunk Search

How to edit the table format in my email alert so that each item starts a new line?

omuelle1
Communicator

Hi Splunkers and Happy Friday

I am trying to put together an email that looks something like this:

alt text

However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:

alt text

The underlying search is this:

| fields - _raw, _time 
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS)  list(PACKQTY)  list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO 
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"

Would anybody know how to get this to have any value in the their own row and not right after each other?

Thank you very much guys,

Oliver

Tags (4)
1 Solution

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

View solution in original post

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

omuelle1
Communicator

I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.

0 Karma

ckunath
Communicator

Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...