topic Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object? in Dashboards & Visualizations

Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

splunkcvc — Wed, 30 Sep 2015 19:52:00 GMT

Issue / Bug?

When scheduling a dashboard object using the $job.earliestTime$ in the email subject, it returns test_dashboard' 1969-12-31T19:00:01.000-05:00. (when epoch started...ish)

However, with other objects like report or saved search, the token $job.earliestTime$ works correctly and results with The scheduled report 'test_dashboard_test' has run. 2015-09-29T00:00:00.000-04:00

Is there a fix or workaround?
Otherwise a mailx script will have to do?

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

helenashton — Fri, 16 Oct 2015 20:03:01 GMT

Did you ever find out any more about this?

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

frobinson_splun — Fri, 16 Oct 2015 20:43:45 GMT

Hi @splunkcvc,
What version of the software are you using?
Thanks,
@frobinson_splunk

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

splunkcvc — Tue, 20 Oct 2015 23:00:20 GMT

I'm using 6.1.4 and 6.2.5

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

frobinson_splun — Thu, 22 Oct 2015 22:01:52 GMT

Thanks, @splunkcvc. Are you seeing the same issue with both versions?

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

splunkcvc — Thu, 22 Oct 2015 23:21:08 GMT

yes,
I'm guessing the issue is because the dashboard with multiple time values , splunk does not know which value to choose from so it, outputs the 1st epoch time (1970).

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

frobinson_splun — Fri, 20 Nov 2015 00:31:57 GMT

Hi @splunkcvc,
If you're scheduling a PDF delivery for a dashboard, then the job.earliestTime token is not supported. See this topic in our documentation to review which contexts (alert actions, PDF delivery, scheduled reports) support which tokens for email notification.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions#Email_notification_contexts

The token, as you observed, is only supported for reports and alert actions.

I hope this helps. Please let me know if you have other questions.

All best,
@frobinson_splunk

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

nehasharma57 — Tue, 27 Sep 2016 06:06:15 GMT

As this is a known issue so do we have any workaround for this?

Re: Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

swmishra_splunk — Mon, 02 Sep 2019 14:47:10 GMT

$job.earliestTime$ and $job.latestTime$ are both job information tokens and they do not work with Dashboards Scheduled PDF Delivery.If you schedule a PDF Report it works but with Dashboards Job information tokens doesn't work.

The above tokens gives information about specific search jobs and a Dashboard is made up of multiple Reports which in turn has multiple searches.So it cannot extract specific search job information. Because of which we are getting some weird results.

The below document clearly states Job information tokens are not supported for Scheduled PDF Delivery for Dashboards.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notifications