topic Modify CSV attachment name when emailed in Getting Data In

Modify CSV attachment name when emailed

zindain24 — Fri, 27 Feb 2015 14:27:04 GMT

I am looking for a way to modify the default CSV name "splunk-results.csv" in version 6.2.1. I need the CSV attachments to be named "$searchname.csv" so I can email them to SharePoint and have the files be identifiable by name.

In older versions of Splunk before 6.0.1 I was able to modify ($splunk_home/etc/apps/search/bin/sendemail.py) but the script changed in one of the more recent versions and I am unable to make it work now.

Greatly appreciate any advice you can offer!

Re: Modify CSV attachment name when emailed

markthompson — Fri, 27 Feb 2015 14:45:05 GMT

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Outputcsv

Take a look there, you can specify the filename

Re: Modify CSV attachment name when emailed

zindain24 — Fri, 27 Feb 2015 15:37:16 GMT

Thanks for your comments Mark, although this command doesn't appear to change the CSV name when emailed.

Any other thoughts?

Re: Modify CSV attachment name when emailed

ben_leung — Thu, 30 Apr 2015 14:19:45 GMT

I also want to know if there is a way to modify the CSV name when emailed.

Re: Modify CSV attachment name when emailed

markthompson — Mon, 28 Sep 2020 19:56:28 GMT

Use the filename arguement.
Syntax: <filename>
Description: Specify the name of a csv file to write the search results. This file should be located in $SPLUNK_HOME/var/run/splunk. If no filename specified, rewrites the contents of each result as a CSV row into the "_xml" field. Otherwise writes into a file (appends ".csv" to filename if filename has no existing extension).