Dashboards & Visualizations
Highlighted

How can I pass a time token to an email in a human readable format?

Legend

Hi at all,
This is a problem that periodically appears!

I created an alert that triggers a condition without results (results = 0)
I have to pass to the email Tokens with trigger date and trigger time.
To do this, I inserted in the email $triggerdate$ and $triggertime$.
Obviously the problem is the time-format of $trigger_time$ that is in epoch time and I need it a human readable format.
I cannot use a search field because my error condition is = 0.

How can I solve this problem?

Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I pass a time token to an email in a human readable format?

SplunkTrust
SplunkTrust

If you're using Splunk Web to create OR edit Alert, during setting up email action, you've option to include "Trigger Time" in the email body (checkbox is available below the Email Body option), which is date and time in human readable format. If you're setting up the alert from savedsearches.conf directly, you can include following attribute to the alert search action.email.include.trigger_time = 1

View solution in original post

0 Karma
Highlighted

Re: How can I pass a time token to an email in a human readable format?

Legend

Thank you somesoni2,
is the position of the Trigger time configurable or fixed in the bottom of email?
Bye.
Giuseppe

0 Karma
Highlighted

Re: How can I pass a time token to an email in a human readable format?

SplunkTrust
SplunkTrust

I don't think it's position is configurable. It will be after "Alert Name", Trigger Condition, Any email body that you setup. (will be above "View Results" link and inline table/events.

0 Karma