Dashboards & Visualizations

How to display result token in email message?

bhavlik
Path Finder

I have a scheduled PDF that I need to display the dates the report was run for. Unfortunately, I just learned that the tokens will not display in the Scheduled PDF as they do when I open the dashboard and then export PDF.

My other option is then to display the dates the report was run for in the email message. I went through the Splunk documentation and several other posts but cannot figure out why my results token is still coming across as blank when email gets sent out.

Here is the search I have created to establish the start and end date for the report. It is the first search and only returns one row of results. I removed using |table due to other posts suggestions and am using |fields instead. I even tried by removing |fields all together and still have no results in my email message.

<search>
    <query>| makeresults 
| eval start = strftime(relative_time(now(), "-1w@w0"),"%m-%d-%Y") 
| eval end = strftime(relative_time(now(),"@w6"),"%m-%d-%Y") 
| eval message="Report was generated from "+start+" through "+end
| fields message</query>
    <progress>
      <set token="message">$result.message$</set>
    </progress>
  </search>

This search is not contained in a panel. It was set up to be outside any panels and then use a token to display as a title for a html panel for text.

In the PDF schedule under Message, I simply put in $result.message$ but is completely blank when emailed. I even tried $message$ since it was set up as the token name but of course that didn't work either.

Anyone have any ideas of why this isn't working or another way to get the dates to display on my scheduled PDF?

Labels (1)

ortiz
Explorer

Did you solved this issue?

0 Karma

bhavlik
Path Finder

I did not.  I ended up adding a separate panel at the top of the dashboard to display the dates for the report.  In my opinion it adds in a lot of white space in the PDF that isn't the most eye pleasing but it gets the job done.  

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...