https://community.splunk.com/t5/Alerting/Alert-e-mail-has-no-Date-field/m-p/109137#M1594 <P>I have gotten alerts to work in Splunk, and they send e-mails. But, unfortunately, there is no Date: field among the e-mail headers.</P> <P>Almost all other e-mails I get have this Date: field, and it is used to sort them. Without a date, the alerts get sorted to the wrong end of my e-mails, which is not helpful.</P> <P>I have looked at python.log, and don't notice anything.</P> <P>What might be wrong?</P> Wed, 16 Nov 2011 00:56:10 GMT mmather67 2011-11-16T00:56:10Z https://community.splunk.com/t5/Alerting/Alert-e-mail-has-no-Date-field/m-p/109137#M1594 <P>I have gotten alerts to work in Splunk, and they send e-mails. But, unfortunately, there is no Date: field among the e-mail headers.</P> <P>Almost all other e-mails I get have this Date: field, and it is used to sort them. Without a date, the alerts get sorted to the wrong end of my e-mails, which is not helpful.</P> <P>I have looked at python.log, and don't notice anything.</P> <P>What might be wrong?</P> Wed, 16 Nov 2011 00:56:10 GMT https://community.splunk.com/t5/Alerting/Alert-e-mail-has-no-Date-field/m-p/109137#M1594 mmather67 2011-11-16T00:56:10Z https://community.splunk.com/t5/Alerting/Alert-e-mail-has-no-Date-field/m-p/109138#M1595 <P>Well, I fixed this myself, by editing splunk/etc/apps/search/bin/sendemail.py.</P> <P>About line 17, before TIMEOUT=600, I added the line:</P> <P>from time import strftime, gmtime, time</P> <P>About line 145, before the comment # Clear leading / trailing whitespace ... I added the line:</P> <P>message ['Date'] = strftime ("%a, %d %b %Y %H:%M:%S", gmtime (time()))</P> <P>That seems to work -- now I just have to remember to make a similar change to any update of Splunk.</P> Wed, 16 Nov 2011 16:12:23 GMT https://community.splunk.com/t5/Alerting/Alert-e-mail-has-no-Date-field/m-p/109138#M1595 mmather67 2011-11-16T16:12:23Z