topic Re: Alert report date range in Alerting

Alert report date range

Engineer_Zen — Wed, 31 Mar 2021 11:49:24 GMT

So when I use

Report Start=$job.earliestTime$

Report End=$job.latestTime$

I am getting the below in my mail as response

Report Start=2021-03-24T06:00:00.000-05:00

Report End=2021-03-31T06:03:00.000-05:00

Apart from the dates what are the other fields I am getting?

Is there anyway I can change them to proper IST

@mayurr98

Re: Alert report date range

manjunathmeti — Wed, 31 Mar 2021 13:52:11 GMT

hi @Engineer_Zen,

Check this page for all available tokens for email alert action.

https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

Alert report date range

richgalloway — Wed, 31 Mar 2021 14:39:03 GMT

You're getting two fields: Report Start and Report End. Both contain a single value which a timestamp in a standard format (year-month-dayThour:minute:second.millisecond-timeZoneOffsetFromUTC).

You can use the strftime function to display the timestamps in a different format.

| eval ReportStart=strftime($job.earliestTime$, "%Y-%m-%d %H:%M:%S%Z")

Re: Alert report date range

Engineer_Zen — Mon, 05 Apr 2021 09:12:50 GMT

Thank you so much for this it worked out for me.

Re: Alert report date range

richgalloway — Mon, 05 Apr 2021 12:35:19 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.