Alerting

Get the search query time range in the Alert message body

dchoubey
Engager

Hello All, 

I have a requirement to display the search query time range in the body of the email alert, is there a way i can do that? 

Search:

index="ABC" source=XYZ earliest=-3month latest=now| table ClientId Restricted Success Rejected Failed Total 

 

I want to display the time range that my search considered in the email alert. 

Thank you

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/8.0.6/Alert/EmailNotificationTokens#Job_information_tok...

you can use email Notification tokens in your email body.

$job.earliestTime$

$job.latestTime$

————————————
If this helps, give a like below.

View solution in original post

inventsekar
SplunkTrust
SplunkTrust
$job.earliestTime$Initial job start time

....the initial job start time is the alert job start time or the "earliest" time the search query time?!?!

or, you can include the whole search query as well (which includes the earliest and latest times)

$search$

Search string

thambisetty
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/8.0.6/Alert/EmailNotificationTokens#Job_information_tok...

you can use email Notification tokens in your email body.

$job.earliestTime$

$job.latestTime$

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...