I have a scheduled report that runs daily. The report just produces a table and sends an email. The time range on the report is 'yesterday'
I'd like to include a formatted date string for yesterday's date in the email subject so for example: "Splunk Report: My Report - March 13, 2016"
So I tried this:
...|eval d=strftime(relative_time(time(), "-d"),"%A, %B %e, %Y")|table field1 field2
But of course now I can't actually access the d field. Is there any way to do this without adding the date to the table?
I guess one option would to update the sendemail.py OR writing your custom script. See following posts
https://answers.splunk.com/answers/302649/is-it-possible-to-use-fields-from-events-to-popula.html
https://answers.splunk.com/answers/33147/insert-date-into-subject-of-email-alert.html