https://community.splunk.com/t5/Alerting/tokens/m-p/669974#M15538 <P>You need to use your result tokens, not just some name out of the blue.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens</A></P> Tue, 28 Nov 2023 07:42:37 GMT PickleRick 2023-11-28T07:42:37Z https://community.splunk.com/t5/Alerting/tokens/m-p/669971#M15537 <P>Hi&nbsp;<BR />I am trying to set up an alert with the following query for the tickets that is not assigned to someone after 10 mins. I wanted the ticket number to get populated in the mail but I am not getting the same rather the mail is without the ticket number.</P><P>index="servicenow"&nbsp; sourcetype=":incident" |where assigned_to = "" | eval age = now() - _time<BR />|where age&gt;600<BR />|table ticket_number, age, assignment_group, team<BR />| lookup team_details.csv team as team OUTPUTNEW alert_email, enable_alert<BR />| where enable_alert = Y<BR />| sendemail to="$alert_email$" subject="Incident no. "$ticket_number$" is not assigned for more than 10 mins - Please take immediate action" message="<BR />Hi Team,<BR />This is to notify you that the ticket: "$ticket_number$" is not assigned for more than 10 mins. Please take necessary action on priority"</P> Tue, 28 Nov 2023 07:32:27 GMT https://community.splunk.com/t5/Alerting/tokens/m-p/669971#M15537 varsh_6_8_6 2023-11-28T07:32:27Z https://community.splunk.com/t5/Alerting/tokens/m-p/669974#M15538 <P>You need to use your result tokens, not just some name out of the blue.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens</A></P> Tue, 28 Nov 2023 07:42:37 GMT https://community.splunk.com/t5/Alerting/tokens/m-p/669974#M15538 PickleRick 2023-11-28T07:42:37Z