How to include search start and end date of the search in email subject?

[tomasz]

Hi all

I would like to include the start and end date of my search in the email subject. For example, 'The results from 2022-11-01 to 2022-11-11'. I tried the email tokens $job.earliestTime$ and $job.latestTime$ but they also give me time which just obscures the title. Is there any way to retrieve just the dates? Any help much appreciated.

Cheers

Tom

[PaulPanther · Accepted solution]

Use addinfo and then use $result.search_starttime$ & $result.search_endtime$ in your alert action

| addinfo
| eval search_starttime = strftime(info_min_time, "%Y-%m-%d")
| eval search_endtime = strftime(info_max_time, "%Y-%m-%d")
| table search_starttime search_endtime

[tomasz]

Hi Paul

Your answer has done exactly what I wanted.

Thank you very much.

[PaulPanther]

Great!Can you please Accept my answer?