Hi,
I need to display the search results start time and end time in the alert email subject line.
How can I do this, I have included $timerange$ in the subject but in the alert email, it was coming as $timerange$ only , please help.
Here is a list of the variables that you can include in the subject line (you will have to scroll down a bit):
Set up alert actions
Also, try these: $job.earliestTime$ and $job.latestTime$
$job.earliestTime$
$job.latestTime$
There is no straightforward way I guess. Have a look at the similar post. http://answers.splunk.com/answers/63372/how-to-include-searched-date-or-time-range-in-alert-report
