TA-XLS Excel Export output commands: Can I add a time stamp in the Subject of the sendfile command?

[chintan_shah]

I am trying to send an email with an Excel attachment and I want to include the current date as well in the Subject of the mail. When I tried the below code:

eval time =relative_time(now(), "-1d@d"),test=strftime(time,"%m-%d"), Subject_line ="Sendfile Test " + test| sendfile "sender" "receiver" "Subject_line" "this is for testing the file" "sample.xls" "smtphost"

I am receiving the mail, but the Subject of the mail is Subject_line and not "Send File Test 08/08"

[dominiquevocat · Accepted solution]

try something like this:

[ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search]

full example:

| outputxls [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com"

I never tried with whitespace in file names

[dominiquevocat]

Hi @chintan_shah,

the parameters for the sendfile (and outputxls) are just strings passed to the custom command. It does not take parameters from fields. I guess it would be possible to do some date macros or some such but i did not think of it because the mail already has a send date :-/. So in essence i think it would be doable to interpret a splunk strftime like string when preparing the email.

[chintan_shah]

Hi Dominique,
Thanks for your reply, agreed that mail will have date but i wanted to provide the current date-1 and wanted to include the same thing in mail message for my requirement. i believe we need to update the script to include the date in mail as well as on subject.

[dominiquevocat]

wait - maybe you can do a subsearch (within [ ] ) and the subsearch will deliver the string for the parameter, just make sure its without whitespace OR in quotes.

[chintan_shah]

Hi Dom,

I tried the search below:

sendfile "sender" "receiver" [search "test" |eval time =relative_time(now(), "-1d@d"),test=strftime(time,"%m-%d"), Subject_line ="Sendfile Test " + test|
top limit=1 Subject_line|eval n=tostring(Subject_line)|table n] "this is for testing the file" "sample.xls" "smtphost" 

but it still gave me return code of 1.

[dominiquevocat]

try something like this:

 [ | stats count | eval search=strftime(now(), "yaddayadda_%Y%m%d.xls") | fields search]

full example:

| outputxls  [ | stats count | eval search=strftime(now(), "yadda_yadda__%Y%m%d.xls") | fields search] "sender@company.com" "recipient@company.com" "subject" "body" "mailhost.company.com"

I never tried with whitespace in file names

[dominiquevocat]

I see. I think i would have to provide a alert action integration to allow this so you could define some tokens there - not sure how to do it and especially when 😕