Splunk Operational Intelligence Cookbook - Third Edition

There's more...

1. This recipe illustrated how tokens can be used in the alert action message. These tokens allow you to create much more meaningful alerts that are populated with data from the alert event itself. This type of token usage can be used with many different types of Splunk Alert Action, including the Email, Log Event, and Slack Alert Actions used in earlier recipes of this chapter.
2. For more information on the types and formats of tokens that can be used, see the Splunk documentation here: https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens.