Splunk Search

Display total events on email subject


Hi All,

Is there a way to display the total number of events in the email body of the alert .

Please note: The search string written is * stats count by field. so, I want the total count in my email subject and the break up in the report.

Tags (1)
0 Karma


@loveforsplunk, You are either looking for $job.resultCount$ which will list number or rows returned by the Search or $result.count$ where count is the field name generated by the search stats count (only first row or search query with single results.

Refer to the following documentation for complete list of tokens available during an email notification: http://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...