Alerts Subject Line

[tomfranc]

Currently the Email Subject in the Alert has a text of "Splunk Alert: $name$" I would like the subject on the email to give the source or at least some indication of what the alert is about instead it only give the name of the alert.

Are there a list of variables that can be used to replace $name%

Thanks,
Tom

[nocostk]

Looking at alert_actions.conf you could use $search$ to reference the search used. Also, further down the page it references some other variables you may be able to use.