When I run a scheduled report with PDF atachment, I can use this token in the email body:
$job.latestTime$
Which will result in the following in the email body when the email is sent:
2018-02-08T10:09:02.000+13:00
How can I format this time/date to be as follows YYYY-MM e.g. 2018-02?
Or one step further would be to do current month minus 1 month e.g. 2018-01?
I was thinking something like this
Assuming:
$job.latestTime$ = 2018-02-08T10:09:02.000+13:00
Then I thought I could do something like this in the email body:
eval x=strptime($job.latestTime$,"%Y-%m-%d")
x = $x$
But this does not work. Can I do what I am trying to do here
docs here which gives a list of the available tokens :
http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports
what about - eval x=strptime($job.latestTime$,"%Y-%m-%d")
2.
3. $result.x$
Assuming x is in the search?
http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...
Is there an answer that works for scheduled dashboards? With a dashboard, I don't believe you have access to the $results... token.
when you say Assuming x is in the search?
I am having trouble with this as it is a dashbord with many searches making tables and charts. So does this still apply?
One of the searches is a table that has a field/column called CallSuccessRate. So I have tried to put $result.CallSuccessRate$ in the email body but that just comes through as a blank in my email.
Do I have to configure something in the scripts?
tks
Tokens available from results
From results, you use the result. token to access the first value of a specified field in search results. This token is available from the following contexts:
Alert actions
Scheduled reports
Token Description
Does not specifically say if the token can be used IN the body of the email, but can you check if $result.CallSuccessRate$ comes in something like the alert subject line or something