Alerting

How to include time field in email message body?

Murali
Explorer

Hi All,

I'm setting an alert and sending email notification to my inbox.

I have a field called Time and basically it calculates the duration. Example:  "25 minutes ago"    

Hence , when I include the field in the message , like below:

$result.Time$   

I get message in my inbox in seconds. 
Example: 

Host abcd CPU usage reached 97% 1680502445 . Please investigate.

So if you look here , the 1680502445 is the time duration in seconds.

It suppose to pick the summarized time as per the column result. 


Murali_0-1680504445252.png

Please help  how can I get the same output like what I have gathered in the Time1 column. 

 

Thanks




Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

could you share your search?

probably the issue is in the Time formatiing, e.g. you could add at the end of your search:

| eval Time=tostring(Time, "duration")

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

could you share your search?

probably the issue is in the Time formatiing, e.g. you could add at the end of your search:

| eval Time=tostring(Time, "duration")

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Murali,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...