I have been having the same issue. I have not been able to solve it. It may not be possible. If you think about it, a dashboard can have multiple searches, which could have different search periods. So the dashboard itself does not really have a "start time" or earliest. It would be good to have a way to set tokens in the dashboard, that are available to the email. We are on splunkcloud, and the default schedule creates a default email template with subject "Splunk Dashboard: '$dashboard.label$' Which is an undocumented token as far as I can see. Are there others that are useful??? If you can dynamically set the dashboard label to the search period in the XLM, then it should be available. I can confirm that I also tried the job.earliestTime and have the same result as you. It is not related to having ALL TIME set for the search. ... View more