Sending entity names in the email triggered from Correlation Searches.

[veerendra_modi]

Hi Team,

I have a KPI with split by entity say "Ent1".
I have made a correlation search using this KPI and in the triggered email, i want to send this entity in the subject line.
Can anybody help me in this regard.

Thanks

[manjunathmeti]

ITSI saved correlation searches as alert. Check with token: $result.fieldname$ in the subject.

From SPlunk documentation:
$result.fieldname$: First value for the specified field name from the first search result row. Verify that the search generates the field being accessed.

[veerendra_modi]

actually my entity is not coming in the generated search