How to display the selected text from log obtained from search in a subject of email while creating an alert ??

[Sawanshar93]

Sample Example
Error occurred in app Myworld123

I want to display app name e.g "Myworld123" in subject of mail.

I can't used result. since that text is not part of any field in a log.

[nawazns5038]

Try to bring the value in top of the result table and use $result.fieldname$ in the subject while setting up the alert where the fieldname is the name of the field that the value is.

If your query does not produce the desired value in the results table try appendcols and join the value to the query.

[Sawanshar93]

I can't use $result.fieldname$ since the text which I want to display as subject is not part of field of log.

[micahkemp]

You can add new fields to your results as you need. | eval subject="This is a test subject" You could then use $result.subject$ in your alert.

[nawazns5038]

try extracting the value through field extraction given by Splunk or by using regex ( rex command )

[somesoni2]

How are you getting that app name then?? A lookup?? Hardcoded/static value??

[Sawanshar93]

app name is name given to particular section of text of log, however there is not such field name appname in either selected field or interesting field of result obtained by triggering queries.

My query is like this,

APP1 OR APP2 OR APP3 java.io.IOException

so whenever this pattern is occurred a new alert will be raised.
alert are getting raised perfectly but we're unable to identified for which APP we're getting that particular error.

suppose alert is raised is raised due to failure of APP2 so we expect APP2 name in our subject of Alert.

as suggested by @nawazns5038, use $result.fieldname$ to extract appname and displayed it to subject but unfortunately whenever we trigger this query we don't get that selected text which we want to display as subject as selected field or interesting field.

We can create 3 separate alert for each app and email subject as hardcode app, but I think this is very redundant and unnecessary.