We want to add the dashboard(not the PDF) link in the email, so that whenever the user clicks on the link can access the dashboard which displays the data for last 1 hr from the time of generation of email.
Thinking that we can fetch the email generation time as the latest time of dashboard base search through the link present in email message.
email message : link to dashboard:"//localhost:port/dashboard"
dashboard base search:
<query> .....</query> <earliest>-1h</earliest> <latest>$tok$</latest>
this $tok$ in dashboard should fetch the email generation time in supported format.
Is it possible?
correct me with the approach.
please help in achieving this.
Hi @chaitanya1996 ,
try this $job.earliestTime$ - $job.latestTime$ to get earliest and latest time in your alert mail and pass this variable as query parameter in your dashboard URL.
your dashboard link -> link to dashboard:http://localhost:8000/en-US/app/myapp/last1hr?form.earliest=$job.earliestTime$&form.latest=$job.late...
Hi @ajitshukla61116 ,
yeah it works fine.
I have used time input field in dashboard with token value as "time" and i have passed the url as: https://localhost:8000/en-US/app//?form.time.earliest=$job.earliestTime$&form.time.latest=$job.lates... in the email message.
You could create an Alert
You could schedule a Report
Or you can use the email PDF feature of a dashboard
The last option, if someone clicks on the link in the email, will load the dashboard "now" (though the PDF will be as-of when it was sent)
But Splunk searches are generally intended to be look at "live" (ie relative time window) data, and not "snapshotted" (fixed time window) data (more or less - that's not absolute, there are exceptions, etc)