Hi @woodcock @sideview  Is there a way i can use sendemail to results of field values.  Details: i have a search results that has set of columns with user and email with different columns. Requirement is when a alert is triggered then results includes with columns: user, user_email, subject, recipient, owner, owner_email then sendemail to ower_email from the values of a results then sends email to ownerofuser1234@email.com, ownerofuser345@email.com, ownerofuser567@email.com.   So, all fields are dynamic and list is large.  eg:  An alert triggered from a search and following are the results of alert. user user_email subject recipient owner owner_email user1234 user1234@email.com cross section from alert 1 recipientname1 ownerofuser1234 ownerofuser1234@email.com user345 user345@email.com cross section from alert 2 recipientname2 ownerofuser345 ownerofuser345@email.com user567 user567@email.com cross section from alert 4 recipientname3 ownerofuser567 ownerofuser567@email.com   Thanks in advance!   ... View more

thanks for the update, i tried below, but still shows the diff | savedsearch "xxxxxx" Token=$Token|s$ in the savedsearch xxxxxx - i have below, just to see whats coming in... index=abc sourcetype=xyz | eval TicketIn=$Token$ | table TicketIn ... View more