Display total events on email subject

[loveforsplunk]

Hi All,

Is there a way to display the total number of events in the email body of the alert .

Please note: The search string written is * stats count by field. so, I want the total count in my email subject and the break up in the report.

[niketn]

@loveforsplunk, You are either looking for $job.resultCount$ which will list number or rows returned by the Search or $result.count$ where count is the field name generated by the search stats count (only first row or search query with single results.

Refer to the following documentation for complete list of tokens available during an email notification: http://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens