Alerting

Alert report date range

Engineer_Zen
Observer

So when I use 

Report Start=$job.earliestTime$

Report End=$job.latestTime$

I am getting the below in my mail as response 

Report Start=2021-03-24T06:00:00.000-05:00

Report End=2021-03-31T06:03:00.000-05:00

 

Apart from the dates what are the other fields I am getting?

Is there anyway I can change them to proper IST

@mayurr98 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're getting two fields: Report Start and Report End.  Both contain a single value which a timestamp in a standard format (year-month-dayThour:minute:second.millisecond-timeZoneOffsetFromUTC).

You can use the strftime function to display the timestamps in a different format.

| eval ReportStart=strftime($job.earliestTime$, "%Y-%m-%d %H:%M:%S%Z")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engineer_Zen
Observer

Thank you so much for this it worked out for me. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

manjunathmeti
Champion

hi @Engineer_Zen,

Check this page for all available tokens for email alert action.

https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens

0 Karma