Custom Subject for Splunk Alert

[vamsi202]

I'm configured an Alert to send mail whenever Error type is triggered in windows event log. I need to customize subject for that alert like server name, event type, event ID in mail.

For Example: Alert triggered for 'ServerName' with 'Event Type' and 'Event ID'

Below is the search im using.

index="wineventlog" source="wineventlog:application" SourceName="MSSQLSERVER" Type=Error
[|inputlookup inv where client_group="*SQLServer Admin*"
|fields name
|rename name as host]
| table _time,host,EventID,Type,Message
| sort _time desc

[rnowitzki · Accepted solution]

Hi @vamsi202 ,

You can reference fields from the search with $result.fieldname$

See https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

Hope this helps.

BR

Ralph

[vamsi202]

That worked. Thanks a lot