Reports Have Changed Since Upgrade to Splunk 6.1

[ezajac]

I have just upgraded to Splunk 6.1. I have daily reports that are sent from Splunk. Before the upgrade the report would get sent and the content of the report would be in the header as well as a record count. Now there is a link to the report in Splunk where you can get the details. How can I get back at a bare minimum the total count of rows returned in the report without clicking on the link?

[ChrisG]

If you are talking about email alerts, in Splunk Enterprise 6.1 you can customize the email using tokens. See the Set up alert actions topic in the Alerting Manual for the specifics.

[ezajac]

To add Row Count, would savedsearches.conf have this configuration now? Where $job.result.Count$ is new?

[Issue Policy Numbers from States]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Splunk Alert: ReportName
action.email.to = email addresses
alert.digest_mode = True
more configurations here
vsid = hmm5pnnl
$job.resultCount$