How to make fields show in an alert?

[unitedmarsupial]

I have an alert based on the below search (obfuscated):

...
| eval APPDIR=source
| rex field=APPDIR mode=sed "s|/logs\/.*||g"
| eventstats values(APPDIR) as APPDIRS
| eval Level=if("/app/5000" IN (APPDIRS), "PRODUCTION", "Non-production")
| eval APPDIRS=mvjoin(APPDIRS, ",")

The idea is to discern the affected application-instance (there are multiple logs under each of the /app/instance/logs/) and then to determine, whether the instance is a production one or not. In the search-results all three new fields (APPDIR, APPDIRS, and Level) are populated as expected.

But they don't show up in the e-mails. The "Subject: $Level$ app in $APPDIRS$" expands to mere "Subject:  app in ". Nor are the fields expanded in the body of the alert e-mail.

Now, I understand, that event-specific fields -- like the singular APPDIR above -- cannot be expected to work in an alert. But the plural APPDIRS, as well as the Level, are aggregates, aren't they?

What am I doing wrong, and how do I fix it?

[richgalloway]

Have you tried "Subject: $result.Level$ app in $result.APPDIRS$"?

[unitedmarsupial]

Oh, I see... But should not it be $result.Level$ -- that is, singular "result", not plural "results"? Thanks!

[richgalloway]

You are correct.  Use the singular form.

[unitedmarsupial]

If you edit your earlier answer to correct the syntax, I'll be able to mark it as the solution...

[richgalloway]

Done

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens