format a token/variable in email a scheduled email with pdf attachment


When I run a scheduled report with PDF atachment, I can use this token in the email body:


Which will result in the following in the email body when the email is sent:


How can I format this time/date to be as follows YYYY-MM e.g. 2018-02?
Or one step further would be to do current month minus 1 month e.g. 2018-01?

I was thinking something like this


$job.latestTime$    = 2018-02-08T10:09:02.000+13:00

Then I thought I could do something like this in the email body:

eval x=strptime($job.latestTime$,"%Y-%m-%d")

x = $x$

But this does not work. Can I do what I am trying to do here

docs here which gives a list of the available tokens :

0 Karma


what about - eval x=strptime($job.latestTime$,"%Y-%m-%d")
3. $result.x$

Assuming x is in the search?

0 Karma


Is there an answer that works for scheduled dashboards? With a dashboard, I don't believe you have access to the $results... token.


when you say Assuming x is in the search?
I am having trouble with this as it is a dashbord with many searches making tables and charts. So does this still apply?

One of the searches is a table that has a field/column called CallSuccessRate. So I have tried to put $result.CallSuccessRate$ in the email body but that just comes through as a blank in my email.

Do I have to configure something in the scripts?


0 Karma


Tokens available from results
From results, you use the result. token to access the first value of a specified field in search results. This token is available from the following contexts:

Alert actions
Scheduled reports
Token Description

$result.fieldname$ Returns the first value for the specified field name from the first result in the search. The field name must be present in the search.

Does not specifically say if the token can be used IN the body of the email, but can you check if $result.CallSuccessRate$ comes in something like the alert subject line or something

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...