# Create a email alert

## Server Setup

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2FgnVXsqiMsSGC2hjhObhz%2Fimage.png?alt=media&#x26;token=6b7fb630-fc8c-49ef-825e-6a238a558f75" alt=""><figcaption></figcaption></figure>

## Create a alert&#x20;

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2F5mVieGFGk7Vj3v1pDoWE%2Fimage.png?alt=media&#x26;token=6a664345-22cc-44c2-a125-bf71b3f47898" alt=""><figcaption></figcaption></figure>

Resources&#x20;

{% embed url="https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0749544" %}

## Troubleshooting

<figure><img src="https://2273033137-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGlSezkssK5aHdG6Al3xJ%2Fuploads%2Fk0t8DsJRGbGoVBgr59fi%2Fimage.png?alt=media&#x26;token=957b48ab-8d3e-4422-a1f4-a90a1fec5e69" alt=""><figcaption></figcaption></figure>



## How to setup email alerts results

You can display Basic values you can put in the Subject or Body

Example:

```
$name$ // Gives you the name of the alert, ex. "Sign in out of US"
```



#### Custom values

The best way i found it to work is make the result query return a table. Splunk will look at the first entry to pull the values from.(ex..if you are returning multi rows it will only read the first for values)

```
| table _time, "User", "Client IP", City, Country
```

In the email you would access the values by

```
Email: $result.User$
IP: $result.Client IP$
City: $result.City$
Country: $result.Country$
```
