About ssn

ssn · ‎12-10-2020

I tried your suggestion but the search is not recognizing the token "job.earliestTime". Also I dont want to show the extra field in result table. MAIN SEARCH | eval job.eTime=strftime(job.earliestTime, "%c") | table FIELD1, FIELD2, job.eTime Then I tried calling $result.job.eTime$ in "Alert Actions"

ssn · ‎12-10-2020

I want to use relative time modifiers (earliest/latest) in mstats command. Not sure how to use the time format. | mstats earliest=-1h avg(xxx) WHERE index=xxx This is failing since it is in relative time format. Documentation mentions about 'timeformat' attribute but I am not sure how to use it for relative time.

ssn · ‎12-10-2020

I am using "sendresults" add-on in "Alert Actions" and tried using $job.earliestTime$ token in the "Message body" section. It works but it shows the value in EPOCH and I want to know how to display it in human readable format.

ssn · ‎12-10-2020

I have used </br> tag in the Alert Actions window/Message Body field for "sendresults". This will add a new line in the content. So it might work for you.

Posts	4
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎12-08-2020

Online Status	Offline
Date Last Visited	‎12-10-2020 01:05 PM

How to use Time modifiers in mstats command?

How to use $job.earliestTime$ token in "sendresult...

Re: How to use $job.earliestTime$ token in "sendre...

How to use Time modifiers in mstats command?

How to use $job.earliestTime$ token in "sendresult...

Re: How to add Line Break in body of the email wit...