topic Re: How to change the alert email trigger time format? in Alerting

How to change the alert email trigger time format?

internet_team — Tue, 04 Aug 2015 15:47:38 GMT

Hello,

I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.

Is there any way to set a 24h format on an alert email?

Mail example :

Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.

Thanks

Re: How to change the alert email trigger time format?

frobinson_splun — Tue, 04 Aug 2015 16:33:24 GMT

Hi, @internet_team,
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.

Best,
@frobinson_splunk

Re: How to change the alert email trigger time format?

frobinson_splun — Tue, 04 Aug 2015 16:52:27 GMT

Hi again!
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:
http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTsearchExamples#search.2Fjobs_GET

I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.

Best,
@frobinson_splunk

Re: How to change the alert email trigger time format?

chanst2 — Tue, 29 Sep 2020 07:02:08 GMT

The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line

ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)

ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)

or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
[sendemail]
filename = sendemail.py
streaming = false
run_in_preview = false
passauth = true
required_fields =
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true

4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content