Alerting

Alert e-mail has no Date: field

Path Finder

I have gotten alerts to work in Splunk, and they send e-mails. But, unfortunately, there is no Date: field among the e-mail headers.

Almost all other e-mails I get have this Date: field, and it is used to sort them. Without a date, the alerts get sorted to the wrong end of my e-mails, which is not helpful.

I have looked at python.log, and don't notice anything.

What might be wrong?

Tags (2)
0 Karma

Path Finder

Well, I fixed this myself, by editing splunk/etc/apps/search/bin/sendemail.py.

About line 17, before TIMEOUT=600, I added the line:

from time import strftime, gmtime, time

About line 145, before the comment # Clear leading / trailing whitespace ... I added the line:

message ['Date'] = strftime ("%a, %d %b %Y %H:%M:%S", gmtime (time()))

That seems to work -- now I just have to remember to make a similar change to any update of Splunk.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!