How to change the alert email trigger time format?



I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.

Is there any way to set a 24h format on an alert email?

Mail example :

Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.


Path Finder

The original python script controlling the $trigger_timeHMS$ is in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line

ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)


ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)

or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
filename =
streaming = false
run_in_preview = false
passauth = true
required_fields =
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true

4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content

0 Karma

Splunk Employee
Splunk Employee

Hi again!
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:

I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.


0 Karma

Splunk Employee
Splunk Employee

Hi, @internet_team,
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.


0 Karma