https://community.splunk.com/t5/Alerting/Email-Alert-Subject/m-p/97980#M1399 <P>From what I've read, it supports $name$ and the name of the saved search, and $seach$ as the search string itself.</P> <P>You can configure scripted alerts as per as <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Configurescriptedalerts#Script_options" target="_blank">alert_actions.conf#Script_options</A>, but you're constrained by these 8:</P> <PRE><CODE>SPLUNK_ARG_0 Script name SPLUNK_ARG_1 Number of events returned SPLUNK_ARG_2 Search terms SPLUNK_ARG_3 Fully qualified query string SPLUNK_ARG_4 Name of saved search SPLUNK_ARG_5 Trigger reason (for example, "The number of events was greater than 1") SPLUNK_ARG_6 Browser URL to view the saved search SPLUNK_ARG_8 File in which the results for this search are stored (contains raw results) </CODE></PRE> <P>If you want to use hosts, then I think you're going to have to play around with custom scripted inputs.</P> <P>Check this link out as well, which can point you in the right direction: <A href="http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content" target="_blank">http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content</A></P> Mon, 28 Sep 2020 12:04:56 GMT rturk 2020-09-28T12:04:56Z https://community.splunk.com/t5/Alerting/Email-Alert-Subject/m-p/97979#M1398 <P>Dear Splunkers:</P> <P>Is there any way to add extra search result field value to alert email subject? like host value<BR /> Thanks in advance!!</P> Fri, 13 Jul 2012 08:37:00 GMT https://community.splunk.com/t5/Alerting/Email-Alert-Subject/m-p/97979#M1398 hjwang 2012-07-13T08:37:00Z https://community.splunk.com/t5/Alerting/Email-Alert-Subject/m-p/97980#M1399 <P>From what I've read, it supports $name$ and the name of the saved search, and $seach$ as the search string itself.</P> <P>You can configure scripted alerts as per as <A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Configurescriptedalerts#Script_options" target="_blank">alert_actions.conf#Script_options</A>, but you're constrained by these 8:</P> <PRE><CODE>SPLUNK_ARG_0 Script name SPLUNK_ARG_1 Number of events returned SPLUNK_ARG_2 Search terms SPLUNK_ARG_3 Fully qualified query string SPLUNK_ARG_4 Name of saved search SPLUNK_ARG_5 Trigger reason (for example, "The number of events was greater than 1") SPLUNK_ARG_6 Browser URL to view the saved search SPLUNK_ARG_8 File in which the results for this search are stored (contains raw results) </CODE></PRE> <P>If you want to use hosts, then I think you're going to have to play around with custom scripted inputs.</P> <P>Check this link out as well, which can point you in the right direction: <A href="http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content" target="_blank">http://splunk-base.splunk.com/answers/34570/how-to-add-custom-email-alert-content</A></P> Mon, 28 Sep 2020 12:04:56 GMT https://community.splunk.com/t5/Alerting/Email-Alert-Subject/m-p/97980#M1399 rturk 2020-09-28T12:04:56Z