Alerting

How to change name of attachments in email alert action in Splunk 6.3?

Melnikovin
Engager

Hi.

In Splunk 6.2 in alerts with email action, all CSV Attachments have a name like "splunk_results.csv" by default. After installation of 6.3, the default name was changed to $name$ token(name of alert).
If I use Russian language in the alert name, I got something like this in half of cases:
"п║п©п╦я│п╬п╨п╫п╬п╡я▀я┘я┐я│я┌п╟п╫п╬п╡п╬п╨_п╥п╟п©я-2015-10-20.csv"

So how can I rename the name of the attached CSV file?

0 Karma

stephane_cyrill
Builder

Hi, you can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py . To rename the attached csv name , rename the default filename (
filename = "splunk-results.csv")
I advice you to see this:

https://answers.splunk.com/answers/2641/how-do-i-customize-scheduled-search-alert-emails.html

0 Karma

Melnikovin
Engager

Thank you. I wiil try.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...