I'm new to Splunk, and I'm having a hard time understanding how to properly format Splunk Email Alerts. I understand that we're able to pull information from the search results to include in the email body (like a field name with:
$result.fieldName$). However, this is limited to the first value of the first row of results.
What if we had 100 events from the query, and we wanted to display the values of
field_A that correspond to
N number of events that have another field
The documentation doesn't seem to discuss anything more complex than pulling out single values, and it's making it difficult to build an email alert that provides charts of diagnostic information.
Any help or useful resources to look at would be appreciated. Thanks.