topic Re: How do I add yesterday's date to an emailed report subject? in Reporting

How do I add yesterday's date to an emailed report subject?

matstap — Fri, 07 Sep 2018 20:12:05 GMT

I have a scheduled report for the previous day's data that gets emailed. I'm trying to include the previous days date in the subject line.

I've tried evaluating a field ReportDate in which the value is yesterday's date and then hiding the field since I don't want it in the report. I then put $result.ReportDate$, but this of course did not work since that field isn't included.

Advice?

Re: How do I add yesterday's date to an emailed report subject?

somesoni2 — Fri, 07 Sep 2018 20:28:29 GMT

I don't think there is any other way possible. You probably have to include the field ReportDate in your search results and then use the token $result.ReportDate$ in alert email subject.

Re: How do I add yesterday's date to an emailed report subject?

woodcock — Sun, 09 Sep 2018 03:01:54 GMT

Add this to your SPL

| eval _yesterday = strftime(relative_time(now(), "-1d@d"), "%m/%d")

Then reference it as $result._yesterday$

Re: How do I add yesterday's date to an emailed report subject?

cmerriman — Thu, 13 Sep 2018 15:51:37 GMT

There is a few job property tokens that you could use for this, I think.
in your email, you could use $job.earliestTime$ or $job.latestTime$ to get the earliest or latest time of the search window.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Alert/EmailNotificationTokens#Job_information_tokens

Re: How do I add yesterday's date to an emailed report subject?

poddraj — Wed, 18 Dec 2019 13:57:54 GMT

Hi Woodcock,

I am having same issue of adding yesterday's date in my email message. You mentioned to add above eval in SPL. Could you please elaborate how to add it.

I tried to add it by editing sendemail.py but it is not working. Do I need to import any packages to use below code
yesterday = datetime.datetime.now() - datetime.timedelta(days = 1)
ssContent['action.email.message'] = argvals.get('message') + " "+ yesterday.strftime("%d.%m.%Y")

Please help.. Sorry for adding comment in this existing post

Re: How do I add yesterday's date to an emailed report subject?

harfel — Wed, 18 Dec 2019 15:03:06 GMT

I don't think you need to modify sendemail.py in order for this to work. If you copy the line above exactly as it is into your SPL, which is your splunk query, it will create a hidden column that evaluates to the previous day. If you want to see the column remove the underscore from the beginning of the name, do | eval yesterday = . . . instead. I would suggest to add the line for the date as the last line of your SPL and use a scheduled report to get the email sent out.

Re: How do I add yesterday's date to an emailed report subject?

woodcock — Wed, 18 Dec 2019 15:43:36 GMT

Open the Saved Search that is generating the email and add my answer to the bottom of the search string and click the Save button. Then to back and edit the email Alert Action associated with the Saved Search and add $result._yesterday$ to the email subject.

Re: How do I add yesterday's date to an emailed report subject?

poddraj — Wed, 18 Dec 2019 16:49:44 GMT

Thanks Woodcock, that worked as perfect as I am looking for..

Re: How do I add yesterday's date to an emailed report subject?

woodcock — Wed, 18 Dec 2019 18:09:05 GMT

OK, then be sure to come back here and click Accept on this answer to close the question and help anybody else coming behind you asking for something similar.

Re: How do I add yesterday's date to an emailed report subject?

tomapatan — Tue, 07 Jan 2025 13:28:00 GMT

thanks, this worked for me as well. Is there a way to rename the csv attached to the report ?