topic Re: change format of token $job.earliesttime$ in Alerting

change format of token $job.earliesttime$

ajitshukla61116 — Wed, 26 Jun 2019 05:55:16 GMT

Hi,
I have an alert query which runs after every 30 minutes and has a relative time range of last 30 minutes. There is a mail action triggered on this search in which i have send $job.earliesttime$ and $ job.latesttime$ which gives me the time period of this search but i need to change the format of this time period to utc .
How can i do it.
Please help

Re: change format of token $job.earliesttime$

sandeepmakkena — Wed, 26 Jun 2019 14:41:41 GMT

| convert ctime($job.earliesttime$) ctime($ job.latesttime$)

This should work.

Re: change format of token $job.earliesttime$

niketn — Wed, 30 Sep 2020 01:03:50 GMT

@ajitshukla61116 You can pipe the addinfo command to your existing search for alert and get info_min_time and info_max_time as earliest and latest time as epoch. Then you can use strftime() to convert epoch time to your expected string time.

Re: change format of token $job.earliesttime$

ajitshukla61116 — Thu, 27 Jun 2019 04:45:30 GMT

Convert ctime is not working.Error is ->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key)."

Re: change format of token $job.earliesttime$

ajitshukla61116 — Thu, 27 Jun 2019 05:08:08 GMT

can you please help me how to do it

Re: change format of token $job.earliesttime$

ajitshukla61116 — Thu, 27 Jun 2019 05:14:34 GMT

ctime isnt working ..error is->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key).". please help

Re: change format of token $job.earliesttime$

jawaharas — Thu, 05 Sep 2019 01:02:26 GMT

As @niketnilay mentioned,
1. You can use addinfo command to get 'Job search time'.
2. Format the timestamp using strftime as below.

| makeresults 
| eval message="My Email Message"
| addinfo
| eval job_search_time=strftime(info_search_time,"%d-%m-%Y")
| table message,job_search_time

And, you can include the custom field in your email subject/body using $result.job_search_time$ field.