Alerting

Is there a way to configure a custom file name for the exported CSV file attached in saved search alert emails?

vasanthmss
Motivator

Hi,

By default, Splunk will export CSV files attached as “splunk-results.csv” and deliver it in the email. Is there a way we can configure our custom file name? like "customname1.csv" or based on the saved search name?

Thanks,
V

V
Labels (2)
1 Solution

somesoni2
Revered Legend

xpac
SplunkTrust
SplunkTrust

As I had the same problem (and this is the first result on Google), I figured out a permanent solution that can be customized per alert.

In savedsearches.conf, go to your alert, and add this line:

action.email.reportFileName = here-goes-your-filename-without-csv-extension

Splunk will then use that setting, add .csv and attach that file to your alert email. As far as I understand it, every setting from alert_actions.conf can be overridden in savedsearches.conf, e.g.

# alert_actions.conf
[email]
reportFileName = something

equals

# savedsearches.conf
alert.email.reportFileName = something

Swap reportFileName with the setting of your choice 😉

0 Karma

knalla
Path Finder

I tried this, it din't work.

0 Karma

ppablo
Retired

Hi @vasanthmss

I noticed you upvoted @somesoni2's answer, but you didn't accept it. If his answer solved your question, please be sure to resolve the post by clicking "Accept" directly below his answer. Always do this for all of your questions that have a working answer.

0 Karma

somesoni2
Revered Legend
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...