Hello @Deepz2612,
I use the following Splunk search for listing all triggered email alerts:
index=_audit source=audittrail sourcetype=audittrail alert_actions=email
| eval _time=trigger_time
| rename ss_name as Alert severity as Severity triggered_alerts as Count
| eval Severity=case(Severity==1,"Info",Severity==2,"Low",Severity==3,"Medium",Severity==4,"High",Severity==5,"Critical")
| table _time,Alert,Severity,Count | sort -_time
About the mail body content: I don't think that Splunk logs the mail body. I could not find it anywhere in the internal indexes. I would suggest that you send your alerts to an additional email address for logging purposes. (You can specify multiple email addresses separated by commas in the alert's settings.)
... View more