I'm configured an Alert to send mail whenever Error type is triggered in windows event log. I need to customize subject for that alert like server name, event type, event ID in mail. For Example: Alert triggered for 'ServerName' with 'Event Type' and 'Event ID' Below is the search im using. index="wineventlog" source="wineventlog:application" SourceName="MSSQLSERVER" Type=Error [|inputlookup inv where client_group="*SQLServer Admin*" |fields name |rename name as host] | table _time,host,EventID,Type,Message | sort _time desc
... View more