I encountered a similar issue. My scenario involved comparing two alerts and wanting to write the results of the test alert to an index while maintaining the same configurations (like throttling) for both.  Using collect wouldn't work, because it was writing duplicate entries to the index due to the alert configuration. I managed to achieve this by directing all the results to: | tojson output_field="foo"   Then in the event field you can just enter: $result.foo$   ... View more

This is exactly what I was looking for!  One interesting thing I noticed, which I am not sure is a bug or not: If you run outputlook up and _time is still in the initial pipeline it will output _time to the lookup This happens even if you explicitly try to remove using the field command   A work around would be to rename time, which works but is not ideal Also to clean this up since this appends to the results of the initial pipeline you will need to follow with a where isnotnull(a), filtering out results on null values that should be present in the appended results. So the resulting search would be something like: ...initial search... ``` If you don't want _time in your resulting lookup ``` | rename _time as time | convert ctime(time) ``` Select fields for outputing to lookup ``` | appendpipe [| fields a, b, c | outputlookup lookup_file] ``` Remove appended entries by filtering on null fields which should only be present in the appended output ``` | where isnotnull(d)   ... View more

There is a workaround that worked for me without reverting back python version.   Go to the following location < Splunk\etc\apps\alert_webhook\bin> and you will find the webhook python script. Add the line I have highlighted below. Then restart Splunk.   ... View more

In my case, index=example | table SID Auto Manual Total Everything looks fine on web. However in email as inline, it shows: Auto Total SID Manual ... View more