I have written a splunk query to extract timeout logs for my functions and am creating a scheduled alert. I have created an email alert action. For the email subject, I want the function name to appear in the subject line. I have tried using $result.fieldname$ and $job.label$ in the subject but it does not give the desired output. For example, if my function test_func fails, I want the subject to look like 'Job Failure for test_func'. For this, I am coding the Subject field in the alert as 'Job Failure for $result.function_name$'. But, it just sends an email alert with subject as 'Job Failure for '. I have also tried using other tokens like '$job.label$', but I couldn't get the desired output. Can somebody please pitch in? ... View more