Just add this to that chart section in the XML source will do: connect ... View more

$trigger_time$ can only show the epoch time, $trigger_timeHMS$ can show a readable time but only in 12-H format and it's without the AM/PM indicator. ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds) the only way to show a proper time value is to override the sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/, either by directly modifying it (not recommended) or put the updated version in another app or etc/system/ Python time format directives can be found here: https://docs.python.org/2/library/time.html I believe any key you can find in the ssContent array of that python script can be used in the email subject or content ... View more

The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/ For my case, I did the followings, 1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/ 2) modify the following line ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds) to ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds) or other time format 3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf [sendemail] filename = sendemail.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true undo_scheduler_escaping = true 4) restart or debug-refresh Splunk to make the configuration effective 5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content ... View more

actually, after adding any sourcetype to the collect command, all fields can be recognized now thanks ... View more

I just tried to upload my screen shot, but too bad that my karma is <60 so that I couldn't upload. When I issued this search command in the Splunk search bar |loadjob events=true savedSearch="admin:xxx:yyy", I got "No results found." as a normal search without any events returned. However, when I issued |loadjob savedSearch="admin:xxx:yyy", I got "Encountered an error while reading file '/aaa/var/run/splunk/dispatch/scheduler__admin_bbb_at_1405558800_3192/results.csv.gz'." In my case, this "events=true" works in both the search view and a dashboard panel ... View more

Please try to add "events=true" as an argument of the loadjob command. Splunk will not return such error even when no events returned for the savedsearch ... View more

Not sure if you are using the same user that created the db lookup to make the search. I was able to get the lookup table when I used the same user. However, when I use a user with fewer capabilities, I got the same problem. I added the dbx_user role to the user who has to search with this db lookup and it worked. However, it will expose the "External Database" section to that user. I'm still finding ways to avoid this while letting that user use the db lookup. ... View more

Hi Streddy, We have the same question here. Have you already come up with a solution? Would be great if you don't mind to share. Thanks. Tak ... View more