|
Is there any way to control the reported fields in an email alert? I have configured splunk to add the search results inline, but I don't need all the fields it is showing. I only want the host and _raw fields to show up in the email. Can you point me in the direction where I can change this behavior? |
2 Answers:
|
You can control this by appending "| fields + host,_raw" to the search string This is exactly what I was looking for. Thank you
(07 May '10, 14:30)
Jaci ♦
|
|
If Splunk is showing more fields then those two (_time) you can remove the fields you don't want by issuing the command | fields - _time after the | fields + host, _raw. Thank you for the answer, this is helpful.
(07 May '10, 14:31)
Jaci ♦
|
