https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506278#M9195 <P>I'm configured an Alert to send mail whenever Error type is triggered in windows event log. I need to customize subject for that alert like server name, event type, event ID in mail.</P><P>For Example: Alert triggered for 'ServerName' with 'Event Type' and 'Event ID'</P><P>Below is the search im using.</P><P>index="wineventlog" source="wineventlog:application" SourceName="MSSQLSERVER" Type=Error<BR />[|inputlookup inv where client_group="*SQLServer Admin*"<BR />|fields name<BR />|rename name as host]<BR />| table _time,host,EventID,Type,Message<BR />| sort _time desc</P> Fri, 26 Jun 2020 10:48:30 GMT vamsi202 2020-06-26T10:48:30Z https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506278#M9195 <P>I'm configured an Alert to send mail whenever Error type is triggered in windows event log. I need to customize subject for that alert like server name, event type, event ID in mail.</P><P>For Example: Alert triggered for 'ServerName' with 'Event Type' and 'Event ID'</P><P>Below is the search im using.</P><P>index="wineventlog" source="wineventlog:application" SourceName="MSSQLSERVER" Type=Error<BR />[|inputlookup inv where client_group="*SQLServer Admin*"<BR />|fields name<BR />|rename name as host]<BR />| table _time,host,EventID,Type,Message<BR />| sort _time desc</P> Fri, 26 Jun 2020 10:48:30 GMT https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506278#M9195 vamsi202 2020-06-26T10:48:30Z https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506280#M9196 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223008">@vamsi202</a>&nbsp;,</P><P>You can reference fields from the search with&nbsp;<SPAN>$result.</SPAN><I>fieldname</I><SPAN>$</SPAN><BR /><BR />See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens</A><BR /><BR />Hope this helps.<BR /><BR />BR<BR /><BR />Ralph</P> Fri, 26 Jun 2020 11:25:16 GMT https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506280#M9196 rnowitzki 2020-06-26T11:25:16Z https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506298#M9198 <P>That worked. Thanks a lot</P> Fri, 26 Jun 2020 14:16:44 GMT https://community.splunk.com/t5/Alerting/Custom-Subject-for-Splunk-Alert/m-p/506298#M9198 vamsi202 2020-06-26T14:16:44Z