How to change the alert email trigger time format?

[internet_team]

Hello,

I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.

Is there any way to set a 24h format on an alert email?

Mail example :

Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.

Thanks

[chanst2]

The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line

ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)

to

ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)

or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
[sendemail]
filename = sendemail.py
streaming = false
run_in_preview = false
passauth = true
required_fields =
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true

4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content

[frobinson_splun]

Hi again!
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:
http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTsearchExamples#search.2Fjobs_GET

I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.

Best,
@frobinson_splunk

[frobinson_splun]

Hi, @internet_team,
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.

Best,
@frobinson_splunk