How should tokens be used to include values of a multi-row search result in my email alert's subject line?

[bharadwaja30]

I want to trigger an email alert when disk usage of any of my servers exceeds 70%. For that, I have written a search query that lists down all the servers that exceeded 70% usage, in a tabular format. Fine. Now I want to include the values of this multi row search result in my mail's subject. How can I make use of tokens to include the values of multi-row search result in my mail's subject?

[gcusello]

Hi bharadwaja30,
see https://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens
every way, with $result.fieldname$ you can insert the first occurrence of your search.
You can also insert a link to the results (there is a check button)
beware to the number of results in your eMail, because if they are too many you could exceed the eMail dimensions limits.
Bye.
Giuseppe

[bharadwaja30]

Hi cusello,

Thank you for responding to my question.

Yeah, $result.fieldname$ gives only the first occurrence of search. That is, the value in the first row of that particular fieldname column. My question is, how to send the values in the 2nd,3rd.. rows of the same column using tokens? Hope you got my question.

[thomasneat]

I can't find an answer to this either and it's been 3 years since this one was asked.

[dailv1808]

me too, Splunk not support maybe

[skjaki786]

I have tried multiple options to show multiple values of single fields from 1st panels output to 2nd panels

it didn't work. I don't see any official documents. 

Is there any expert can suggest on this?

[PickleRick]

1. Calling specific people to answer your question is plain rude. This is a volunteer-driven community and people respond to publicly posted question if/when they want. If you want a response in a timely manner - you have to purchase some support/consultancy services from one of many Splunk partners or Splunk's own Professional Services.

2. Digging up a thread from 5 years ago is not very likely to produce meaningful results. Create a new thread, describe your problem. If your problem is similar to an old one, you could link to the old one for reference.