Splunk Search

How to include only certain fields in an email sent from an alert

riotto
Path Finder

I have an alert that looks for a pattern in an event that is an xml: ie.

":2017-03-01 06:02:16,194 INFO 7010 System Error 7025 Failed Request Build null null"

I want to send the email that includes only the TransactionStatusMessageDetail field, but I get the _raw sent
(Failed Request Build) is the field
Can this be done? Splunk Enterprise version is 6.1

0 Karma
1 Solution

woodcock
Esteemed Legend

Just add | table TransactionStatusMessageDetail as the last part of your search.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just add | table TransactionStatusMessageDetail as the last part of your search.

View solution in original post

0 Karma

riotto
Path Finder

Works like a champ!...thanks

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!