How should tokens be used to include values of a multi-row search result in my email alert's subject line?


I want to trigger an email alert when disk usage of any of my servers exceeds 70%. For that, I have written a search query that lists down all the servers that exceeded 70% usage, in a tabular format. Fine. Now I want to include the values of this multi row search result in my mail's subject. How can I make use of tokens to include the values of multi-row search result in my mail's subject?

0 Karma

Esteemed Legend

Hi bharadwaja30,
every way, with $result.fieldname$ you can insert the first occurrence of your search.
You can also insert a link to the results (there is a check button)
beware to the number of results in your eMail, because if they are too many you could exceed the eMail dimensions limits.

0 Karma


Hi cusello,

Thank you for responding to my question.

Yeah, $result.fieldname$ gives only the first occurrence of search. That is, the value in the first row of that particular fieldname column. My question is, how to send the values in the 2nd,3rd.. rows of the same column using tokens? Hope you got my question.


I can't find an answer to this either and it's been 3 years since this one was asked.

0 Karma

Path Finder

me too, Splunk not support maybe

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...