This is old, but in case anyone comes here looking for an answer... for tokens used in email or other alert actions (e.g. ServiceNow INC creation), in Splunk 9.4+ it simply works when using field names with spaces. So if you have a fieldname with spaces, produced from a search with something like: | table Queue "Message Count" Then you can include that field in the alert/SNow action with: $result.Message Count$ ... View more