How to include only certain fields in an email sent from an alert

[riotto]

I have an alert that looks for a pattern in an event that is an xml: ie.

":2017-03-01 06:02:16,194 INFO 7010 System Error 7025 Failed Request Build null null"

I want to send the email that includes only the TransactionStatusMessageDetail field, but I get the _raw sent
(Failed Request Build) is the field
Can this be done? Splunk Enterprise version is 6.1

[woodcock · Accepted solution]

Just add | table TransactionStatusMessageDetail as the last part of your search.

[riotto]

Works like a champ!...thanks

[woodcock]

Be sure to click Accept to close the question.