https://community.splunk.com/t5/Alerting/how-can-I-use-quot-timestamp-quot-field-with-an-alert-action/m-p/417186#M7259 <P>I have "@timestamp" field in search results. I'd like to use the value in my alert message for slack.<BR /> So, I tried to use it like</P> <PRE><CODE>$result.@timestamp$, $result.message$ </CODE></PRE> <P>But, <CODE>@timestamp</CODE> value won't appear in the alert message. What do I do wrong?</P> <P>Thanks,<BR /> Hiroshi</P> Thu, 04 Oct 2018 19:50:35 GMT okug 2018-10-04T19:50:35Z https://community.splunk.com/t5/Alerting/how-can-I-use-quot-timestamp-quot-field-with-an-alert-action/m-p/417186#M7259 <P>I have "@timestamp" field in search results. I'd like to use the value in my alert message for slack.<BR /> So, I tried to use it like</P> <PRE><CODE>$result.@timestamp$, $result.message$ </CODE></PRE> <P>But, <CODE>@timestamp</CODE> value won't appear in the alert message. What do I do wrong?</P> <P>Thanks,<BR /> Hiroshi</P> Thu, 04 Oct 2018 19:50:35 GMT https://community.splunk.com/t5/Alerting/how-can-I-use-quot-timestamp-quot-field-with-an-alert-action/m-p/417186#M7259 okug 2018-10-04T19:50:35Z https://community.splunk.com/t5/Alerting/how-can-I-use-quot-timestamp-quot-field-with-an-alert-action/m-p/417187#M7260 <P>Try to rename it to eliminate the @ character before using in token. Something like <CODE>rename "@timestamp" as timestamp</CODE></P> Thu, 04 Oct 2018 19:55:08 GMT https://community.splunk.com/t5/Alerting/how-can-I-use-quot-timestamp-quot-field-with-an-alert-action/m-p/417187#M7260 Vijeta 2018-10-04T19:55:08Z