Reporting

How to include Start Time and End Time in the message body of a scheduled email report?

skathpal
Explorer

Hello Experts,

Need help to setup the output action of Reports where in message body I can see the start and end time of report data. Let say I scheduled the report every 3 Hours via email(Output Action). In Email message body we want to see the time of the report . Start time 3 Pm and End time 6 Pm so that system owner knows its 3 hours data from 3pm to 6 pm.

Sample
Message Body

Report Name: Top 10 External IP Denied

Report Start Time: Which field ??
Report End Time : ???

Description: Displays the top 10 foreign addresses that were denied inbound access by external firewall.

Hope my question is clear.

1 Solution

vasanthmss
Motivator

Hi Skathpal,

Try This,

Report Start = $job.earliestTime$
Report End= $job.latestTime$

For more Info Read this Link

Cheers!!!

V

View solution in original post

vasanthmss
Motivator

Hi Skathpal,

Try This,

Report Start = $job.earliestTime$
Report End= $job.latestTime$

For more Info Read this Link

Cheers!!!

V

HiroshiSatoh
Champion

You can add the 「info_min_time」 and 「info_max_time」 in 「| addinfo」.

・info_min_time: the earliest time bound for the search
・info_max_time: the latest time bound for the search

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...