https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450699#M55447 <P>Try as below mentioned (for sending email as an action from ES App"</P> <BLOCKQUOTE> <P>'$field_name$'</P> </BLOCKQUOTE> Fri, 10 May 2019 04:27:17 GMT sumanssah 2019-05-10T04:27:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450698#M55446 <P>Creating alerts using InfoSec App, adaptive response set to email, but in the email body i'm trying to query src, dest and action fields.</P> <P>I've tried everything such as $src$, with/without quotes, dollar sign but still not working. anything will help!</P> Fri, 10 May 2019 00:42:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450698#M55446 YangThomas 2019-05-10T00:42:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450699#M55447 <P>Try as below mentioned (for sending email as an action from ES App"</P> <BLOCKQUOTE> <P>'$field_name$'</P> </BLOCKQUOTE> Fri, 10 May 2019 04:27:17 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450699#M55447 sumanssah 2019-05-10T04:27:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450700#M55448 <P>Does this work for the InfoSec App? trying to do some testing between the 2. </P> <P>I believe too, to rephrase my question, im trying to insert tokens into the body of my email message. I just want it to display </P> <P>source, destination, action, and possibly ports. the instructions weren't as clear as to what to insert. </P> Fri, 10 May 2019 16:41:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/InfoSec-App/m-p/450700#M55448 YangThomas 2019-05-10T16:41:01Z