Dashboards & Visualizations

Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

New Member

Issue / Bug?

When scheduling a dashboard object using the $job.earliestTime$ in the email subject, it returns test_dashboard' 1969-12-31T19:00:01.000-05:00. (when epoch started...ish)

However, with other objects like report or saved search, the token $job.earliestTime$ works correctly and results with The scheduled report 'test_dashboard_test' has run. 2015-09-29T00:00:00.000-04:00

Is there a fix or workaround?
Otherwise a mailx script will have to do?

0 Karma

Splunk Employee
Splunk Employee

$job.earliestTime$ and $job.latestTime$ are both job information tokens and they do not work with Dashboards Scheduled PDF Delivery.If you schedule a PDF Report it works but with Dashboards Job information tokens doesn't work.

The above tokens gives information about specific search jobs and a Dashboard is made up of multiple Reports which in turn has multiple searches.So it cannot extract specific search job information. Because of which we are getting some weird results.

The below document clearly states Job information tokens are not supported for Scheduled PDF Delivery for Dashboards.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notif...

0 Karma

Splunk Employee
Splunk Employee

Hi @splunkcvc,
If you're scheduling a PDF delivery for a dashboard, then the job.earliestTime token is not supported. See this topic in our documentation to review which contexts (alert actions, PDF delivery, scheduled reports) support which tokens for email notification.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions#Email_notification_context...

The token, as you observed, is only supported for reports and alert actions.

I hope this helps. Please let me know if you have other questions.

All best,
@frobinson_splunk

0 Karma

New Member

As this is a known issue so do we have any workaround for this?

0 Karma

New Member

yes,
I'm guessing the issue is because the dashboard with multiple time values , splunk does not know which value to choose from so it, outputs the 1st epoch time (1970).

0 Karma

New Member

I'm using 6.1.4 and 6.2.5

0 Karma

Splunk Employee
Splunk Employee

Thanks, @splunkcvc. Are you seeing the same issue with both versions?

0 Karma

Splunk Employee
Splunk Employee

Hi @splunkcvc,
What version of the software are you using?
Thanks,
@frobinson_splunk

0 Karma

Path Finder

Did you ever find out any more about this?

0 Karma