Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Re: How to use tokens for PDF Delivery alerts
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to use tokens for PDF Delivery alerts
I have an alert that runs every Tuesday at 2:30 pm.
The alert Body is as follows
Subject
“BLAH BLAH "-------the date when this alert runs
Body
Hello
Please find attached talert as on .
Regards
Asish
Now filed should dynamically appear while the alert is running, but since it is a PDF alert i am unable to bring the from PDF using token $result.Date$(I have already created the field in my alert query).
Please help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You cannot generate PDFs for forms -- that is, for dashboards or reports that have interactivity with tokens -- only for dashboards and reports. See the limits here...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ASISH_9, among the default tokens for email alert, $result.<YourFieldName>$ is also available. So $result.Date$ should work if you have the same in your alert result.
Refer to the Splunk Documentatoin for all the tokens:
http://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem is $result.$ is not working in case of PDF Delivery alerts.
My question was is there any way to make this work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I also have the date field in my alert(which i am calling through token $result.Date$)...but tis not working
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
