I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.
Is there any way to set a 24h format on an alert email?
Mail example :
Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.
The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line
ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)
ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)
or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
filename = sendemail.py
streaming = false
run_in_preview = false
passauth = true
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true
4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:
I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.