Alerting

Getting dates, times in alert emails into a consistent format

HarAtWork
Explorer

Splunk randomly varies the style in which dates and times are available. In an alert email, $job.trigger_date$ comes out as "March 04, 2023", and then I have to have it display $job.trigger_timeHMS$ afterwards to get "21:45:06 -0500". On the other hand, $job.earliestTime$ comes out "2023-03-04T20:00:00.000-05 00" and $job.latestTime comes out similarly.

Is there a way to get them all to come out consistently formatted like "March 4, 2023, 21:45:06"? (And then I can suffix it with "Eastern Time".)

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

https://ideas.splunk.com

---
If this reply helps you, Karma would be appreciated.
0 Karma

HarAtWork
Explorer

That's the home page of a posting board.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's where we go to suggest enhancements and report problems such as this one.  There's no much else we can do about inconsistencies in Splunk's code.

---
If this reply helps you, Karma would be appreciated.

HarAtWork
Explorer

Oh, I see. I didn't realize you were telling me what I now think you're telling me, that there isn't currently any solution for achieving the result I was looking for.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...