How to change name of attachments in email alert action in Splunk 6.3?



In Splunk 6.2 in alerts with email action, all CSV Attachments have a name like "splunk_results.csv" by default. After installation of 6.3, the default name was changed to $name$ token(name of alert).
If I use Russian language in the alert name, I got something like this in half of cases:

So how can I rename the name of the attached CSV file?

0 Karma


Hi, you can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/ . To rename the attached csv name , rename the default filename (
filename = "splunk-results.csv")
I advice you to see this:

0 Karma


Thank you. I wiil try.

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...