Reporting

Add yesterday's date to scheduled report email subject

Engager

I have a scheduled report that runs daily. The report just produces a table and sends an email. The time range on the report is 'yesterday'

I'd like to include a formatted date string for yesterday's date in the email subject so for example: "Splunk Report: My Report - March 13, 2016"

So I tried this:
...|eval d=strftime(relative_time(time(), "-d"),"%A, %B %e, %Y")|table field1 field2

But of course now I can't actually access the d field. Is there any way to do this without adding the date to the table?

SplunkTrust
SplunkTrust
0 Karma