Alerting

change format of token $job.earliesttime$

ajitshukla61116
Path Finder

Hi,
I have an alert query which runs after every 30 minutes and has a relative time range of last 30 minutes. There is a mail action triggered on this search in which i have send $job.earliesttime$ and $ job.latesttime$ which gives me the time period of this search but i need to change the format of this time period to utc .
How can i do it.
Please help

0 Karma

jawaharas
Motivator

As @niketnilay mentioned,
1. You can use addinfo command to get 'Job search time'.
2. Format the timestamp using strftime as below.

| makeresults 
| eval message="My Email Message"
| addinfo
| eval job_search_time=strftime(info_search_time,"%d-%m-%Y")
| table message,job_search_time

--

And, you can include the custom field in your email subject/body using $result.job_search_time$ field.

0 Karma

ajitshukla61116
Path Finder

Convert ctime is not working.Error is ->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key)."

0 Karma

niketn
Legend

@ajitshukla61116 You can pipe the addinfo command to your existing search for alert and get info_min_time and info_max_time as earliest and latest time as epoch. Then you can use strftime() to convert epoch time to your expected string time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ajitshukla61116
Path Finder

can you please help me how to do it

0 Karma

sandeepmakkena
Contributor

| convert ctime($job.earliesttime$) ctime($ job.latesttime$)

This should work.

0 Karma

ajitshukla61116
Path Finder

ctime isnt working ..error is->"Error in 'convert' command: The conversion specifier is invalid. It must be convert_type(key).". please help

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...