How should tokens be used to include values of a multi-row search result in my email alert's subject line?

[bharadwaja30]

I want to trigger an email alert when disk usage of any of my servers exceeds 70%. For that, I have written a search query that lists down all the servers that exceeded 70% usage, in a tabular format. Fine. Now I want to include the values of this multi row search result in my mail's subject. How can I make use of tokens to include the values of multi-row search result in my mail's subject?

[gcusello]

Hi bharadwaja30,
see https://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens
every way, with $result.fieldname$ you can insert the first occurrence of your search.
You can also insert a link to the results (there is a check button)
beware to the number of results in your eMail, because if they are too many you could exceed the eMail dimensions limits.
Bye.
Giuseppe

[bharadwaja30]

Hi cusello,

Thank you for responding to my question.

Yeah, $result.fieldname$ gives only the first occurrence of search. That is, the value in the first row of that particular fieldname column. My question is, how to send the values in the 2nd,3rd.. rows of the same column using tokens? Hope you got my question.

[thomasneat]

I can't find an answer to this either and it's been 3 years since this one was asked.

[dailv1808]

me too, Splunk not support maybe