I would like to display the job schedule time in the alert subject line.
For example, I have an alert which is running for the last 15 mins, I wanted to display the Job start time, and present time in subject line.
I'm running 6.2.5
To be clear the issue is happening with only dashboards converted to pdf format and emailed via pdf delivery option.
I think the issue with splunk's dashboard mode because there's multiple panels it doesn't know where to grab a timestamp value.
Unlike saved searches and reports the there's only 1 time stamp value being passed.
what version are you running? Only the more recent versions of splunk allow you to include these tokens.
When changed the subject line to be
Splunk Report: $job.earliestTime$
I got the following in my email subject line
Splunk Report: 2015-02-04T22:30:00.000+00:00
I am running 6.1.5
I am also using splunk 6.1.5
when I am running below details in search I am getting the date in subject line
sendemail to=XXXXX@splunk.com server=XXXXXXXXXXXXXXX subject="failures between $job.earliestTime$ and $job.latestTime$" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true
But when I am running the query in app (We have created seperate app for alerting), I am getting empty results. Do I need to do any modification in the app to get the exact result? I mean I have enabled "send email" option in the alert setting.
Have you tried walking through the workflow in the save alert screen, as opposed to using sendemail? I would not expect there to be a different behavior there, but given that it should work...
Yes, I have. When I use "$trigger_time$" in the subject line field, It is working (Getting results as 1422965960 instead of date) but when I am using $job.earliestTime$ i am getting empty.