Can you put a non-tabled field in an alert title?

[nick405060]

I want to be able to put a token in my alert title that is derived from a field NOT in the displayed results table.

How? The below does not work:

| makeresults | eval a="junk" | eval b="junk" | eval _a=a | table b + Splunk Alert: $name$ $result._a$

[nick405060]

99% sure this is a bug. It seems the table, fields, and stats commands breaks the tokenization of hidden fields. Per the below, and per other users I have talked to on 7.3, this issue exists from at least version 7.0 forwards.

https://answers.splunk.com/answers/342128/why-does-resultfieldname-token-not-work-in-alert-e.html

@the_tick mentioned maybe using field aliases to workaround, or sendalert. I haven't tried either of those workarounds yet, but this was my solution:

| makeresults | eval a="mysubject" | eval b="mycontent" | map maxsearches=10000 search="| makeresults | eval b=\"$b$\" | table b | sendemail server=smtp.gadsden.com to=\"myemail@gadsden.com\" subject=\"$a$\" message=\"Results:\" sendresults=true inline=true"

To adapt this template to your search, simply calculate the fields that you'll want to tokenize, before the map, and dedup to only be one row of data (e.g. you probably won't be using makeresults). Next, in the map, write your actual alert and in sendemail you can now use the calculated tokens from before the map.

This is a sanitized example of my query:

index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords="Audit Failure") user=amkfk NOT Source_Workstation="TABLET3849" NOT Source_Workstation="TOKYO_OFFICE" NOT Source_Workstation="MKK_SURFPRO7"| rex field=_raw "Error Code:\s+(?<error_code>\S+)" | stats values(error_code) AS error_codes | eval error_codes=mvjoin(error_codes,",") | table error_codes |
map maxsearches=10000 search="search index=wineventlog (EventCode=4771 OR EventCode=4776 AND Keywords=\"Audit Failure\") user=amkfk NOT Source_Workstation=\"TABLET3849\" NOT Source_Workstation=\"TOKYO_OFFICE\" NOT Source_Workstation=\"MKK_SURFPRO7\" | rex field=_raw \"Error Code:\s+(?<error_code>\S+)\" | sort 0 _time | table _time user EventCode Source_Workstation ComputerName Keywords error_code | sendemail server=smtp.mydomain.com to=\"myemail@mydomain.com\" subject=\"Splunk Alert: amkfk_4771_4776 ($error_codes$)\" message=\"Results:\" sendresults=true inline=true"

[to4kawa]

eval _subject=subject

underbar field is unvisible.
you should change field name.

action.email.subject.alert = Splunk Alert: $name$ ($result._subject$)
don't forget this ,too.

[nick405060]

I changed the field name to mysubject - both in the SPL and in the alert subject - with the same result.