Hi There's a documentation bug for 2.0.0 as the tenant_uid has to be specified now. The correct search would be: | makeresults | eval user="World", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default param.tenant_uid=default  Hope this helps!   ... View more