Alerting

How to get a timestamp to show in the 'Log Event' alert action?

brittonware
New Member

I have an alert that logs an event and sends an email. I am trying to add the timestamp of the event to the Log Event action, but it is not being added to the log event. The timestamp is correct in the alert's search table and also being added to the Email message correctly. However, it does not show up in the Log Event.

 

| eval event_timestamp==strftime(_time,"%Y-%m-%dT%H:%M:%S")
| table event_timestamp

 


Log Event - [Event input]:

 

...
event_timestamp=$result.event_timestamp$
...

 


Send Email action - [Message input]:

 

...
Event Timestamp: $result.event_timestamp$
Priority: XYZ
...

 


I have also noticed that if I put the timestamp before other fields in the 'Log Event' action, then those fields are also missing in the log.

Any ideas why Log Event isn't working when adding a timestamp to it?

Labels (1)
Tags (2)
0 Karma

brittonware
New Member

There is a small typo in my first code block. The two equals signs should only be one.

| eval event_timestamp=strftime(_time,"%Y-%m-%dT%H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...