I have an alert that looks for a pattern in an event that is an xml: ie.
":2017-03-01 06:02:16,194 INFO 7010 System Error 7025 Failed Request Build null null"
I want to send the email that includes only the TransactionStatusMessageDetail field, but I get the _raw sent
(Failed Request Build) is the field
Can this be done? Splunk Enterprise version is 6.1
Just add | table TransactionStatusMessageDetail as the last part of your search.
| table TransactionStatusMessageDetail
View solution in original post
Works like a champ!...thanks
Be sure to click Accept to close the question.