Dashboards & Visualizations

Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

splunkcvc
New Member

Issue / Bug?

When scheduling a dashboard object using the $job.earliestTime$ in the email subject, it returns test_dashboard' 1969-12-31T19:00:01.000-05:00. (when epoch started...ish)

However, with other objects like report or saved search, the token $job.earliestTime$ works correctly and results with The scheduled report 'test_dashboard_test' has run. 2015-09-29T00:00:00.000-04:00

Is there a fix or workaround?
Otherwise a mailx script will have to do?

0 Karma

swmishra_splunk
Splunk Employee
Splunk Employee

$job.earliestTime$ and $job.latestTime$ are both job information tokens and they do not work with Dashboards Scheduled PDF Delivery.If you schedule a PDF Report it works but with Dashboards Job information tokens doesn't work.

The above tokens gives information about specific search jobs and a Dashboard is made up of multiple Reports which in turn has multiple searches.So it cannot extract specific search job information. Because of which we are getting some weird results.

The below document clearly states Job information tokens are not supported for Scheduled PDF Delivery for Dashboards.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notif...

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @splunkcvc,
If you're scheduling a PDF delivery for a dashboard, then the job.earliestTime token is not supported. See this topic in our documentation to review which contexts (alert actions, PDF delivery, scheduled reports) support which tokens for email notification.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions#Email_notification_context...

The token, as you observed, is only supported for reports and alert actions.

I hope this helps. Please let me know if you have other questions.

All best,
@frobinson_splunk

0 Karma

nehasharma57
New Member

As this is a known issue so do we have any workaround for this?

0 Karma

splunkcvc
New Member

yes,
I'm guessing the issue is because the dashboard with multiple time values , splunk does not know which value to choose from so it, outputs the 1st epoch time (1970).

0 Karma

splunkcvc
New Member

I'm using 6.1.4 and 6.2.5

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Thanks, @splunkcvc. Are you seeing the same issue with both versions?

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @splunkcvc,
What version of the software are you using?
Thanks,
@frobinson_splunk

0 Karma

helenashton
Path Finder

Did you ever find out any more about this?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!