Inject username in email alert

New Member

I have a Cisco ASA and my users VPN into it. I have created an alert based on the search below and it works. In the body of the alert it lists the "username = blah" (with the user's name"). Is it possible to inject that username into the subject of the email alert?

index=netfw sourcetype="cisco:asa" eventtype=cisco_vpn_end Cisco_ASA_message_id=113019

Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!