Reporting
Highlighted

Alerts Subject Line

New Member

Currently the Email Subject in the Alert has a text of "Splunk Alert: $name$" I would like the subject on the email to give the source or at least some indication of what the alert is about instead it only give the name of the alert.

Are there a list of variables that can be used to replace $name%

Thanks,
Tom

Tags (2)
0 Karma
Highlighted

Re: Alerts Subject Line

Communicator

Looking at alert_actions.conf you could use $search$ to reference the search used. Also, further down the page it references some other variables you may be able to use.

0 Karma