Hello @Deepz2612,
I use the following Splunk search for listing all triggered email alerts:
index=_audit source=audittrail sourcetype=audittrail alert_actions=email
| eval _time=trigger_time
| rename ss_name as Alert severity as Severity triggered_alerts as Count
| eval Severity=case(Severity==1,"Info",Severity==2,"Low",Severity==3,"Medium",Severity==4,"High",Severity==5,"Critical")
| table _time,Alert,Severity,Count | sort -_time
About the mail body content: I don't think that Splunk logs the mail body. I could not find it anywhere in the internal indexes. I would suggest that you send your alerts to an additional email address for logging purposes. (You can specify multiple email addresses separated by commas in the alert's settings.)
