Alerting

How to include time field in email message body?

Murali
Explorer

Hi All,

I'm setting an alert and sending email notification to my inbox.

I have a field called Time and basically it calculates the duration. Example:  "25 minutes ago"    

Hence , when I include the field in the message , like below:

$result.Time$   

I get message in my inbox in seconds. 
Example: 

Host abcd CPU usage reached 97% 1680502445 . Please investigate.

So if you look here , the 1680502445 is the time duration in seconds.

It suppose to pick the summarized time as per the column result. 


Murali_0-1680504445252.png

Please help  how can I get the same output like what I have gathered in the Time1 column. 

 

Thanks




Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

could you share your search?

probably the issue is in the Time formatiing, e.g. you could add at the end of your search:

| eval Time=tostring(Time, "duration")

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

could you share your search?

probably the issue is in the Time formatiing, e.g. you could add at the end of your search:

| eval Time=tostring(Time, "duration")

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...