http://answers.splunk.com/answers/40540/how-can-i-keep-order-of-fields-in-plain-format-of-an-alert-email In short, Splunk will reorder by field width on email even if you define them via 'table', or 'fields'. Refer to the above link to fix this issue. ... View more