What the SPLUNK?

[jon_yarbrough]

hi everyone, i'm new to Splunk and i've read through the tons of forums and i can't find the solution to my problem. what i'm trying to do is to change the headers and the information that is shown when an email alert is sent to me with the errors that i determined i would like to view. i have no idea where i can find the headers or where/how to create a custom search result. do i need to create a script or something and if i do, where does the script go? does it go in the scripts folder on the SPLUNK server or on the web base UI?

[gekoner]

In the WebGUI go to Manager --> Searches and Reports. Either create a new Saved Search (I wasn't sure if you had already created one or not) or edit the search you want change the email notification for.
Under the Schedule and alert section, mark the check-box labeled Schedule this search
You should then see all of the fields available for you to edit.
Under Alert actions, find Send email, and mark the check-box that says "Enable"

You can then modify the Email subject, Email address(es), and what to include in the results of your email.
For more options and functionality see this post -http://splunk-base.splunk.com/answers/621/email-alert-subject