Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

[splunkcvc]

Issue / Bug?

When scheduling a dashboard object using the $job.earliestTime$ in the email subject, it returns test_dashboard' 1969-12-31T19:00:01.000-05:00. (when epoch started...ish)

However, with other objects like report or saved search, the token $job.earliestTime$ works correctly and results with The scheduled report 'test_dashboard_test' has run. 2015-09-29T00:00:00.000-04:00

Is there a fix or workaround?
Otherwise a mailx script will have to do?

[swmishra_splunk]

$job.earliestTime$ and $job.latestTime$ are both job information tokens and they do not work with Dashboards Scheduled PDF Delivery.If you schedule a PDF Report it works but with Dashboards Job information tokens doesn't work.

The above tokens gives information about specific search jobs and a Dashboard is made up of multiple Reports which in turn has multiple searches.So it cannot extract specific search job information. Because of which we are getting some weird results.

The below document clearly states Job information tokens are not supported for Scheduled PDF Delivery for Dashboards.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notif...

[frobinson_splun]

Hi @splunkcvc,
If you're scheduling a PDF delivery for a dashboard, then the job.earliestTime token is not supported. See this topic in our documentation to review which contexts (alert actions, PDF delivery, scheduled reports) support which tokens for email notification.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions#Email_notification_context...

The token, as you observed, is only supported for reports and alert actions.

I hope this helps. Please let me know if you have other questions.

All best,
@frobinson_splunk

[nehasharma57]

As this is a known issue so do we have any workaround for this?

[splunkcvc]

yes,
I'm guessing the issue is because the dashboard with multiple time values , splunk does not know which value to choose from so it, outputs the 1st epoch time (1970).

[splunkcvc]

I'm using 6.1.4 and 6.2.5

[frobinson_splun]

Thanks, @splunkcvc. Are you seeing the same issue with both versions?

[frobinson_splun]

Hi @splunkcvc,
What version of the software are you using?
Thanks,
@frobinson_splunk

[helenashton]

Did you ever find out any more about this?