i would like to have variables from my query in my email subject. is this possible?
There's a limited number of variables that can be used now: http://splunk-base.splunk.com/answers/27329/what-variables-can-you-use-in-email-subject
Not really. Take a look at alert_actions.conf documentation as it has some variables. You can put in a feature request for more options in the alert_actions at http://www.splunk.com/index.php/submit_issue.
