Splunk Scheduled PDF - Use token on mail subject

[nuaraujo]

Hello everyone

I have a scheduled PDF delivery mail, where I want to manipulate the mail subject, using a mail token. Basically, I want to add the word SUCCESS or ERROR, to the mail subject.

To achieve this, on my dashboard, I am using a global search, where I am creating a token, using the following code:

<search id="get_status_token">
    <query>my_search_here
| eval fstatus=if(AAA==BBB AND CCC==DDD  , "SUCCESS","ERROR")
| fields fstatus</query>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <set token="fstatus">$result.fstatus$</set>
    </done>
  </search>

On the EDIT PDF SCHEDULE menu, I adding the following code as Subject

TEST $fstatus$

but the email does never display the value of the token in the subject.

Can someone help me find what am I missing?

NOTE: I am using the token in the email subject and not in the PDF.

Thanks in advance

[masonmorales · Accepted solution]

Instead of setting a token in the XML of the report, try using a token with the sendemail command.
i.e.

<query>my_search_here
 | eval fstatus=if(AAA==BBB AND CCC==DDD  , "SUCCESS","ERROR")
 | fields fstatus
 | sendemail [email protected] sendpdf=t subject=$result.fstatus$</query> 

[nuaraujo]

Thanks @masonmorales for the quick reply, but since in this dashboard I have 3 different searches, this would require at least 3 mails.