How to select fields for email alert

[Jaci]

Is there any way to control the reported fields in an email alert? I have configured splunk to add the search results inline, but I don't need all the fields it is showing. I only want the host and _raw fields to show up in the email. Can you point me in the direction where I can change this behavior?

[Dan · Accepted solution]

You can control this by appending "| fields + host,_raw" to the search string

[CerielTjuh · Accepted solution]

If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw.

[Jaci]

Thank you for the answer, this is helpful.

[Dan · Accepted solution]

You can control this by appending "| fields + host,_raw" to the search string

[Jaci]

This is exactly what I was looking for. Thank you