splunk email alert subject - Splunk Community

Alerting

i would like to have variables from my query in my email subject. is this possible?

There's a limited number of variables that can be used now: http://splunk-base.splunk.com/answers/27329/what-variables-can-you-use-in-email-subject

Not really. Take a look at alert_actions.conf documentation as it has some variables. You can put in a feature request for more options in the alert_actions at http://www.splunk.com/index.php/submit_issue.

There are no answer without questions

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...