Alerting

How to change the alert email trigger time format?

Explorer

Hello,

I set up an alert to send an email when the trigger condition is reached. I receive the email, but the time format is always shown in a 12h format.

Is there any way to set a 24h format on an alert email?

Mail example :

Alert: My alert name
Trigger Time: 10:05:02 on August 03, 2015.

Thanks

Path Finder

The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/
For my case, I did the followings,
1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/
2) modify the following line

ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds)

to

ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds)

or other time format
3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf
[sendemail]
filename = sendemail.py
streaming = false
run_in_preview = false
passauth = true
required_fields =
changes_colorder = false
supports_rawargs = true
undo_scheduler_escaping = true

4) restart or debug-refresh Splunk to make the configuration effective
5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content

0 Karma

Splunk Employee
Splunk Employee

Hi again!
Just letting you know that I've asked our engineering team about this. I discovered that the trigger time you see in an alert email is actually search job metadata. This is accessible at the /search/jobs REST endpoint, if you're curious:
http://docs.splunk.com/Documentation/Splunk/6.2.4/RESTREF/RESTsearchExamples#search.2Fjobs_GET

I'm still looking into whether the rendered trigger time can be formatted in any other way. It may not be possible at this time, but I'll let you know what I find out. Feel free to let me know if you have further questions.

Best,
@frobinson_splunk

0 Karma

Splunk Employee
Splunk Employee

Hi, @internet_team,
I'm a tech writer at Splunk and I work on alerting documentation. This is an interesting question! I'd like to help. I am looking into an answer and I'll post some information for you soon.

Best,
@frobinson_splunk

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!