How to send field as Token in Alerts

[LizAndy123]

So I have my Query working and I have a webhook created in a Channel

It says that I can send Tokens when I send the Alert - It says the Message can include tokens that insert text based on the result of search query

My Field / Label I created was Total_Count

How do I pass that as a Token?

[LizAndy123]

I have a follow up on this or should I start again?

I can send the token and it works, but I am doing a search where one of the fields is a sum 

Example stats sum(SizeGB)

What the search is doing is getting the total number of Data uploaded for a Project and the report works great however I was want to send the figure as a token in the alert - I can send the project id but not the sum - I have tried $testresult.sum(SizeGB)$ and also I did an eval of the Sum and called it total_size and tried that as a token and it is just blank.

[PickleRick · Accepted solution]

https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens

You need to use $result.your_field_name$ in your case it will be $result.Total_Count$

[LizAndy123]

Thanks, worked great