Hello,
I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.
Is there any way to set a 24h format on an alert email?
Mail example :
Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.
Thanks
The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line
ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)
to
ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)
or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
[sendemail]
filename = sendemail.py
streaming = false
run_in_preview = false
passauth = true
required_fields =
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true
4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content
Hi again!
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:
http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTsearchExamples#search.2Fjobs_GET
I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.
Best,
@frobinson_splunk
Hi, @internet_team,
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.
Best,
@frobinson_splunk