Dashboards & Visualizations

How to format date in email subject for alert trigger action

nadxieli
New Member

Hi!
I use alerts with Trigger Actions --> send email, and I need to insert the date in the subject in the email.
I tried to use the token $result._time$ print in unix format.

Could you help me please for change the format, for example, "Splunk alert: 13/08/2019 11:23:65"?

Regards.

0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

As the last step of you search you can format you time to what ever you need. Just add this after your search:

Use this if you want to use the event time ( _time )
| eval email_time = strftime(_time,"%d/%m/%Y %H:%M:%S")

Or this if you want the current time ( now() ) when the search was executed
| eval email_time = strftime(now(),"%d/%m/%Y %H:%M:%S")

The different its just the source field being used to generate the timestamp and then use strftime to format it however you want.

You can then use $result.email_time$ in your alert.

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

diogofgm
SplunkTrust
SplunkTrust

As the last step of you search you can format you time to what ever you need. Just add this after your search:

Use this if you want to use the event time ( _time )
| eval email_time = strftime(_time,"%d/%m/%Y %H:%M:%S")

Or this if you want the current time ( now() ) when the search was executed
| eval email_time = strftime(now(),"%d/%m/%Y %H:%M:%S")

The different its just the source field being used to generate the timestamp and then use strftime to format it however you want.

You can then use $result.email_time$ in your alert.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

nadxieli
New Member

Hi! @diogofgm in my search add the command fields with the new field 'email_time' so I can pass the token to email

Thanks you, Regards!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...