How can I pass a time token to an email in a human readable format?

[gcusello]

Hi at all,
This is a problem that periodically appears!

I created an alert that triggers a condition without results (results = 0)
I have to pass to the email Tokens with trigger date and trigger time.
To do this, I inserted in the email $trigger_date$ and $trigger_time$.
Obviously the problem is the time-format of $trigger_time$ that is in epoch time and I need it a human readable format.
I cannot use a search field because my error condition is = 0.

How can I solve this problem?

Bye.
Giuseppe

[somesoni2 · Accepted solution]

If you're using Splunk Web to create OR edit Alert, during setting up email action, you've option to include "Trigger Time" in the email body (checkbox is available below the Email Body option), which is date and time in human readable format. If you're setting up the alert from savedsearches.conf directly, you can include following attribute to the alert search action.email.include.trigger_time = 1

[gcusello]

Thank you somesoni2,
is the position of the Trigger time configurable or fixed in the bottom of email?
Bye.
Giuseppe

[somesoni2]

I don't think it's position is configurable. It will be after "Alert Name", Trigger Condition, Any email body that you setup. (will be above "View Results" link and inline table/events.