Alert report date range

[Engineer_Zen]

So when I use 

Report Start=$job.earliestTime$

Report End=$job.latestTime$

I am getting the below in my mail as response 

Report Start=2021-03-24T06:00:00.000-05:00

Report End=2021-03-31T06:03:00.000-05:00

Apart from the dates what are the other fields I am getting?

Is there anyway I can change them to proper IST

@mayurr98 

[richgalloway]

You're getting two fields: Report Start and Report End.  Both contain a single value which a timestamp in a standard format (year-month-dayThour:minute:second.millisecond-timeZoneOffsetFromUTC).

You can use the strftime function to display the timestamps in a different format.

| eval ReportStart=strftime($job.earliestTime$, "%Y-%m-%d %H:%M:%S%Z")

[Engineer_Zen]

Thank you so much for this it worked out for me. 

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[manjunathmeti]

hi @Engineer_Zen,

Check this page for all available tokens for email alert action.

https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens