Re: tokens in Email Alert - Splunk Community

Dashboards & Visualizations

Search| table ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details

Splunk Alert: "$results.ERROR_CD$ $results.HAWB$"

I am using the following value for email subject , returning empty..

Any advise how can use field values as email tokens?

It's working.

I should be using 'result' instead of 'results'

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...