I have a scheduled PDF that I need to display the dates the report was run for. Unfortunately, I just learned that the tokens will not display in the Scheduled PDF as they do when I open the dashboard and then export PDF.
My other option is then to display the dates the report was run for in the email message. I went through the Splunk documentation and several other posts but cannot figure out why my results token is still coming across as blank when email gets sent out.
Here is the search I have created to establish the start and end date for the report. It is the first search and only returns one row of results. I removed using |table due to other posts suggestions and am using |fields instead. I even tried by removing |fields all together and still have no results in my email message.
<search>
<query>| makeresults
| eval start = strftime(relative_time(now(), "-1w@w0"),"%m-%d-%Y")
| eval end = strftime(relative_time(now(),"@w6"),"%m-%d-%Y")
| eval message="Report was generated from "+start+" through "+end
| fields message</query>
<progress>
<set token="message">$result.message$</set>
</progress>
</search>
This search is not contained in a panel. It was set up to be outside any panels and then use a token to display as a title for a html panel for text.
In the PDF schedule under Message, I simply put in $result.message$ but is completely blank when emailed. I even tried $message$ since it was set up as the token name but of course that didn't work either.
Anyone have any ideas of why this isn't working or another way to get the dates to display on my scheduled PDF?
