Hi in addition to using tokens as was suggested you can template the body of the message by configuring alert_actions.conf For example you could have an alert_actions.conf (don't update the etc/system/default one) and add   [email] message.alert = Please fill this report in as follows\ Step 1\ Step 2\ \ And finally\ Step 3     I use the \ because you want the message.alert value to span multiple lines. That should get you something like the attached screenshot.   More details here  https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf ... View more