Splunk Enterprise 6.1 Email Alerts

[ezajac]

I have just upgraded to Splunk 6.1. I have daily reports that are sent from Splunk. Before the upgrade the report would get sent and the content of the report would be in the header as well as a record count. Now there is a link to the report in Splunk where you can get the details. How can I get back at a bare minimum the total count of rows returned in the report without clicking on the link?

This was suggested:
If you are talking about email alerts, in Splunk Enterprise 6.1 you can customize the email using tokens. See the Set up alert actions topic in the Alerting Manual for the specifics.

Would this work?

To add Row Count, would savedsearches.conf have this configuration now? Where $job.result.Count$ is new?
[Issue Policy Numbers from States]
action.email = 1
action.email.inline = 1
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Splunk Alert: ReportName
action.email.to = email addresses
alert.digest_mode = True
more configurations here
vsid = hmm5pnnl
$job.resultCount$

[nfilippi_splunk]

Splunk Enterprise 6.1 allows you to customize the email message body with whatever text you want to include, along with making several tokens available for use. For reports, we tokenize all parameters returned from the search/job/server endpoints, as well as the first result that gets returned.

For a better list of tokens, you can refer to the common tokens highlighted in the docs.
http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Setupalertactions

In your specific case, you can use the token, $job.resultCount$ in your message.