Alerting

change format of token $job.earliesttime$

Path Finder

Hi,
I have an alert query which runs after every 30 minutes and has a relative time range of last 30 minutes. There is a mail action triggered on this search in which i have send $job.earliesttime$ and $ job.latesttime$ which gives me the time period of this search but i need to change the format of this time period to utc .
How can i do it.
Please help

0 Karma

Motivator

As @niketnilay mentioned,
1. You can use addinfo command to get 'Job search time'.
2. Format the timestamp using strftime as below.

| makeresults 
| eval message="My Email Message"
| addinfo
| eval job_search_time=strftime(info_search_time,"%d-%m-%Y")
| table message,job_search_time

--

And, you can include the custom field in your email subject/body using $result.job_search_time$ field.

0 Karma

Path Finder

Convert ctime is not working.Error is ->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key)."

0 Karma

Legend

@ajitshukla61116 You can pipe the addinfo command to your existing search for alert and get info_min_time and info_max_time as earliest and latest time as epoch. Then you can use strftime() to convert epoch time to your expected string time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

can you please help me how to do it

0 Karma

Contributor

| convert ctime($job.earliesttime$) ctime($ job.latesttime$)

This should work.

0 Karma

Path Finder

ctime isnt working ..error is->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key).". please help

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!