All Apps and Add-ons

TA-XLS Excel Export output commands: Can I add a time stamp in the Subject of the sendfile command?

chintan_shah
Path Finder

I am trying to send an email with an Excel attachment and I want to include the current date as well in the Subject of the mail. When I tried the below code:

eval time =relative_time(now(), "-1d@d"),test=strftime(time,"%m-%d"), Subject_line ="Sendfile Test " + test| sendfile "sender" "receiver" "Subject_line" "this is for testing the file" "sample.xls" "smtphost"

I am receiving the mail, but the Subject of the mail is Subject_line and not "Send File Test 08/08"

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

try something like this:

[ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search]

full example:

| outputxls [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com"

I never tried with whitespace in file names

View solution in original post

dominiquevocat
SplunkTrust
SplunkTrust

try something like this:

[ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search]

full example:

| outputxls [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com"

I never tried with whitespace in file names

dominiquevocat
SplunkTrust
SplunkTrust

Hi @chintan_shah,

the parameters for the sendfile (and outputxls) are just strings passed to the custom command. It does not take parameters from fields. I guess it would be possible to do some date macros or some such but i did not think of it because the mail already has a send date :-/. So in essence i think it would be doable to interpret a splunk strftime like string when preparing the email.

0 Karma

chintan_shah
Path Finder

Hi Dominique,
Thanks for your reply, agreed that mail will have date but i wanted to provide the current date-1 and wanted to include the same thing in mail message for my requirement. i believe we need to update the script to include the date in mail as well as on subject.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

wait - maybe you can do a subsearch (within [ ] ) and the subsearch will deliver the string for the parameter, just make sure its without whitespace OR in quotes.

0 Karma

chintan_shah
Path Finder

Hi Dom,

I tried the search below:

sendfile "sender" "receiver" [search "test" |eval time =relative_time(now(), "-1d@d"),test=strftime(time,"%m-%d"), Subject_line ="Sendfile Test " + test|
top limit=1 Subject_line|eval n=tostring(Subject_line)|table n] "this is for testing the file" "sample.xls" "smtphost" 

but it still gave me return code of 1.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

try something like this:

 [ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search]

full example:

| outputxls  [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com"

I never tried with whitespace in file names

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

I see. I think i would have to provide a alert action integration to allow this so you could define some tokens there - not sure how to do it and especially when 😕

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...