I have a Cisco ASA and my users VPN into it. I have created an alert based on the search below and it works. In the body of the alert it lists the "username = blah" (with the user's name"). Is it possible to inject that username into the subject of the email alert?
index=netfw sourcetype="cisco:asa" eventtype=cisco_vpn_end Cisco_ASA_message_id=113019
