Dashboards & Visualizations

How to display result token in email message?

Path Finder

I have a scheduled PDF that I need to display the dates the report was run for. Unfortunately, I just learned that the tokens will not display in the Scheduled PDF as they do when I open the dashboard and then export PDF.

My other option is then to display the dates the report was run for in the email message. I went through the Splunk documentation and several other posts but cannot figure out why my results token is still coming across as blank when email gets sent out.

Here is the search I have created to establish the start and end date for the report. It is the first search and only returns one row of results. I removed using |table due to other posts suggestions and am using |fields instead. I even tried by removing |fields all together and still have no results in my email message.

    <query>| makeresults 
| eval start = strftime(relative_time(now(), "-1w@w0"),"%m-%d-%Y") 
| eval end = strftime(relative_time(now(),"@w6"),"%m-%d-%Y") 
| eval message="Report was generated from "+start+" through "+end
| fields message</query>
      <set token="message">$result.message$</set>

This search is not contained in a panel. It was set up to be outside any panels and then use a token to display as a title for a html panel for text.

In the PDF schedule under Message, I simply put in $result.message$ but is completely blank when emailed. I even tried $message$ since it was set up as the token name but of course that didn't work either.

Anyone have any ideas of why this isn't working or another way to get the dates to display on my scheduled PDF?

Labels (1)


Did you solved this issue?

0 Karma

Path Finder

I did not.  I ended up adding a separate panel at the top of the dashboard to display the dates for the report.  In my opinion it adds in a lot of white space in the PDF that isn't the most eye pleasing but it gets the job done.  

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...