https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683715#M15904 <P>If you edit your earlier answer to correct the syntax, I'll be able to mark it as the solution...</P> Tue, 09 Apr 2024 16:10:53 GMT unitedmarsupial 2024-04-09T16:10:53Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683691#M15899 <P>I have an alert based on the below search (obfuscated):</P><P>&nbsp;</P><LI-CODE lang="css">... | eval APPDIR=source | rex field=APPDIR mode=sed "s|/logs\/.*||g" | eventstats values(APPDIR) as APPDIRS | eval Level=if("/app/5000" IN (APPDIRS), "PRODUCTION", "Non-production") | eval APPDIRS=mvjoin(APPDIRS, ",")</LI-CODE><P>&nbsp;</P><P>The idea is to discern the affected application-instance (there are multiple logs under each of the <FONT face="courier new,courier">/app/<EM>instance</EM>/logs/</FONT>) and then to determine, whether the instance is a production one or not. In the search-results all three new fields (APPDIR, APPDIRS, and Level) are populated as expected.</P><P>But they don't show up in the e-mails. The "<FONT face="courier new,courier">Subject: $Level$ app in $APPDIRS$</FONT>" expands to mere "<FONT face="courier new,courier">Subject:&nbsp; app in</FONT> ". Nor are the fields expanded in the body of the alert e-mail.</P><P>Now, I understand, that event-specific fields -- like the singular APPDIR above -- cannot be expected to work in an alert. But the plural APPDIRS, as well as the Level, are aggregates, aren't they?</P><P>What am I doing wrong, and how do I fix it?</P> Tue, 09 Apr 2024 14:32:45 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683691#M15899 unitedmarsupial 2024-04-09T14:32:45Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683694#M15900 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens</A></P> Tue, 09 Apr 2024 14:37:10 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683694#M15900 PickleRick 2024-04-09T14:37:10Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683696#M15901 <P>Have you tried <FONT face="courier new,courier">"Subject: $result.Level$ app in $result.APPDIRS$"<FONT face="arial,helvetica,sans-serif">?</FONT></FONT></P> Tue, 09 Apr 2024 16:32:06 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683696#M15901 richgalloway 2024-04-09T16:32:06Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683711#M15902 <P>Oh, I see... But <A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens" target="_blank" rel="noopener">should not it be</A> $result.Level$ -- that is, singular "result", not plural "results"? Thanks!</P> Tue, 09 Apr 2024 15:37:47 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683711#M15902 unitedmarsupial 2024-04-09T15:37:47Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683712#M15903 <P>You are correct.&nbsp; Use the singular form.</P> Tue, 09 Apr 2024 15:47:39 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683712#M15903 richgalloway 2024-04-09T15:47:39Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683715#M15904 <P>If you edit your earlier answer to correct the syntax, I'll be able to mark it as the solution...</P> Tue, 09 Apr 2024 16:10:53 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683715#M15904 unitedmarsupial 2024-04-09T16:10:53Z https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683718#M15905 <P>Done</P> Tue, 09 Apr 2024 16:32:21 GMT https://community.splunk.com/t5/Alerting/How-to-make-fields-show-in-an-alert/m-p/683718#M15905 richgalloway 2024-04-09T16:32:21Z