Hi all
I would like to include the start and end date of my search in the email subject. For example, 'The results from 2022-11-01 to 2022-11-11'. I tried the email tokens $job.earliestTime$ and $job.latestTime$ but they also give me time which just obscures the title. Is there any way to retrieve just the dates? Any help much appreciated.
Cheers
Tom
Use addinfo and then use $result.search_starttime$ & $result.search_endtime$ in your alert action
| addinfo
| eval search_starttime = strftime(info_min_time, "%Y-%m-%d")
| eval search_endtime = strftime(info_max_time, "%Y-%m-%d")
| table search_starttime search_endtime
Use addinfo and then use $result.search_starttime$ & $result.search_endtime$ in your alert action
| addinfo
| eval search_starttime = strftime(info_min_time, "%Y-%m-%d")
| eval search_endtime = strftime(info_max_time, "%Y-%m-%d")
| table search_starttime search_endtime
Hi Paul
Your answer has done exactly what I wanted.
Thank you very much.
Great!Can you please Accept my answer?