Token Help on Alerts after search

[LizAndy123]

So I had help before that after a search I could send a report on a schedule and send a token to a mattermost channel

I can send the token and it works, but I am doing a search where one of the fields is a sum 

Example stats sum(SizeGB) which is getting the sum of a Project ID for a day.

What the search is doing is getting the total number of Data uploaded for a Project and the report works great however I was want to send the figure as a token in the alert - I can send the project id but not the sum - I have tried $testresult.sum(SizeGB)$ and also I did an eval of the Sum and called it total_size and tried that as a token and it is just blank.

[ITWhisperer]

Try $result.my_sum$

[gcusello · Accepted solution]

Hi @LizAndy123 ,

It's always a best practice to name the operations, so use 

sum(SizeGB) AS my_sum

and then use my_sum in the token.

Ciao.

Giuseppe