How do I set up a Splunk alert email subject as token?

[dataengineer]

I have written a splunk query to extract timeout logs for my functions and am creating a scheduled alert. I have created an email alert action. For the email subject, I want the function name to appear in the subject line. I have tried using $result.fieldname$ and $job.label$ in the subject but it does not give the desired output.

For example, if my function test_func fails, I want the subject to look like 'Job Failure for test_func'. For this, I am coding the Subject field in the alert as 'Job Failure for $result.function_name$'. But, it just sends an email alert with subject as 'Job Failure for '. I have also tried using other tokens like '$job.label$', but I couldn't get the desired output.

Can somebody please pitch in?

[ITWhisperer]

$result.fieldname$ should work but it only works for the first row of your results. Please check that your field has a value in the first row.

[dataengineer]

Do you mean the values in the first row of the output events? Or do you mean the value in the first row of the inline table? Both of those have values in the first row. And I tried testing with $result.fieldname$ but got an empty response for that.

What other way can I get the function name in the email subject?

[ITWhisperer]

Can you share your search SPL in a code block </>?

[dataengineer]

This is the spunk search:

index=xyz
"Timing out job_id"
"fields.kubernetes.namespace_name"="xyz"
test_function OR test_function2

This is the email subject: Job Failure: $result.fields.kubernetes.pod_name$

This is the email message I am using:  There were $job.resultCount$ errors reported on $trigger_date$. The $job.label$ run instance failed.

$result.fields.kubernetes.pod_name$ does not give me the pod_name (which is like my function name)

[ITWhisperer]

You could try renaming it so that it doesn't have dots in