Splunk Search

How to edit the table format in my email alert so that each item starts a new line?

omuelle1
Communicator

Hi Splunkers and Happy Friday

I am trying to put together an email that looks something like this:

alt text

However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:

alt text

The underlying search is this:

| fields - _raw, _time 
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS)  list(PACKQTY)  list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO 
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"

Would anybody know how to get this to have any value in the their own row and not right after each other?

Thank you very much guys,

Oliver

Tags (4)
1 Solution

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

View solution in original post

omuelle1
Communicator

We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:

| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls"  list(ord_qty_btls) AS "ord_qty_btls"  list(ShortQty) as "short_qty" list(item_description)  as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" |  rex mode=sed field=ship_qty_btls "s/:/\n/g" |  rex mode=sed field=short_qty "s/:/\n/g" 
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g" 

omuelle1
Communicator

I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.

0 Karma

ckunath
Communicator

Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...