https://community.splunk.com/t5/Reporting/Alerts-Subject-Line/m-p/63433#M1424 <P>Looking at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf">alert_actions.conf</A> you could use $search$ to reference the search used. Also, further down the page it references some other variables you may be able to use.</P> Wed, 30 May 2012 13:44:57 GMT nocostk 2012-05-30T13:44:57Z https://community.splunk.com/t5/Reporting/Alerts-Subject-Line/m-p/63432#M1423 <P>Currently the <EM>Email Subject</EM> in the Alert has a text of "Splunk Alert: $name$" I would like the subject on the email to give the source or at least some indication of what the alert is about instead it only give the name of the alert.</P> <P>Are there a list of variables that can be used to replace $name%</P> <P>Thanks,<BR /> Tom</P> Wed, 30 May 2012 13:16:30 GMT https://community.splunk.com/t5/Reporting/Alerts-Subject-Line/m-p/63432#M1423 tomfranc 2012-05-30T13:16:30Z https://community.splunk.com/t5/Reporting/Alerts-Subject-Line/m-p/63433#M1424 <P>Looking at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf">alert_actions.conf</A> you could use $search$ to reference the search used. Also, further down the page it references some other variables you may be able to use.</P> Wed, 30 May 2012 13:44:57 GMT https://community.splunk.com/t5/Reporting/Alerts-Subject-Line/m-p/63433#M1424 nocostk 2012-05-30T13:44:57Z