https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472160#M7249 <P>You can not customize it in Splunk. You would need to do it manually every time.<BR /> Further, when you discuss "sheets", that's an Excel/spreadsheet concept, not a csv concept.</P> Fri, 14 Feb 2020 14:42:24 GMT efavreau 2020-02-14T14:42:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472159#M7248 <P>Hi,</P> <P>I have a requirement to customize the report generated in csv format, this is a scheduled report.<BR /> The report in .csv must have two sheets. First sheet should have splunk logo and time frame the report is for.<BR /> Second sheet should contain report name and the data .</P> <P>Is there any way i customize the csv to include the above.</P> <P>Thanks,<BR /> Ajay</P> Fri, 14 Feb 2020 10:19:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472159#M7248 ajayrejin 2020-02-14T10:19:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472160#M7249 <P>You can not customize it in Splunk. You would need to do it manually every time.<BR /> Further, when you discuss "sheets", that's an Excel/spreadsheet concept, not a csv concept.</P> Fri, 14 Feb 2020 14:42:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472160#M7249 efavreau 2020-02-14T14:42:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472161#M7250 <P>Okay. Can i use custom token in the email header of the report to show the month for which the report is run.<BR /> like use eval to create a custom field and use that field in the email header.</P> Mon, 24 Feb 2020 07:26:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472161#M7250 ajayrejin 2020-02-24T07:26:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472162#M7251 <P>Not exactly. However, in the docs, there's a list of variables that can be used:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/Latest/Alert/EmailNotificationTokens">https://docs.splunk.com/Documentation/Splunk/Latest/Alert/EmailNotificationTokens</A></P> <P>You could edit some conf files to create a new variable. Or you might be able to find something you can use with <CODE>$job.latestTime$</CODE> or <CODE>$result.fieldname$</CODE> </P> Mon, 24 Feb 2020 20:11:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Customize-report/m-p/472162#M7251 efavreau 2020-02-24T20:11:09Z