Alerting

How to get a timestamp to show in the 'Log Event' alert action?

brittonware
New Member

I have an alert that logs an event and sends an email. I am trying to add the timestamp of the event to the Log Event action, but it is not being added to the log event. The timestamp is correct in the alert's search table and also being added to the Email message correctly. However, it does not show up in the Log Event.

 

| eval event_timestamp==strftime(_time,"%Y-%m-%dT%H:%M:%S")
| table event_timestamp

 


Log Event - [Event input]:

 

...
event_timestamp=$result.event_timestamp$
...

 


Send Email action - [Message input]:

 

...
Event Timestamp: $result.event_timestamp$
Priority: XYZ
...

 


I have also noticed that if I put the timestamp before other fields in the 'Log Event' action, then those fields are also missing in the log.

Any ideas why Log Event isn't working when adding a timestamp to it?

Labels (1)
Tags (2)
0 Karma

brittonware
New Member

There is a small typo in my first code block. The two equals signs should only be one.

| eval event_timestamp=strftime(_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...