I found that someone else had asked this, but as it was asked in 2015, I thought I would ask as well.
Correlation searches contain many different "Adaptive Response Actions", one such action is the "Send email" action. This action contains multiple fields to be filled in such as: To, Priority, Subject, Message, Include, and Type. The "Message" field will come pre filled. The "Message" field will display in the body of an email when triggered.
Now the problem is that even if you were to change the "Message", the body of the email that is actually sent will not update. Splunk does save the new Message, so what you wrote will not be deleted, but it will not send with the email, as it does with Alerts.
The reason this is an issue for me, is because I am trying to make getting to a search based off of info from the event easier. I planned on including something that would refer to the results and add it as a link in the email, ie
https://splunksite.com/app/search/search?something | where $result.count$>x
If there is another way to make this work aside from making an alert out of the correlation search and using an alert action, please let me know. I do not want to be running two searches for the exact same thing just so one can email correctly while the other makes Notable Events correctly.
Thank you.
