I have looked at the SPLUNK documentation (https://docs.splunk.com/Documentation/Splunk/7.2.9/Alert/EmailNotificationTokens) regarding tokens that can be used in emails when a notable event triggers. The notable event provides a title for the alert, however it appears that the tokens available in the notable event can't be sent via email. The only option seems to be using the description but sometimes the title of a notable event vs the description may and is different. Anyone else run into this and could suggest a way around this. It may be that a less informative (more generic) title is put in to the alert by using a something like an eval, for example
| eval title="very generic alert for something"
And then using this in $results.title$ but that seems like wasted effort. Any thoughts on how to get the title of the notable event to be sent on an email? Note using Enterprise Security.
