Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search

[landrujw]

I need to change the format of the name of the .csv attachments on reports from my organization's saved searches. I've gone through the older solutions but they don't seem to be valid anymore.
The goal is when a report sends an email with a .csv attachment to have the timestamp be "$name$-$time:%Y-%m-%d-%H:%M:%S$" instead of just "$name$-$time:%Y-%m-%d".
Neither setting the reportFileName in alert_actions.conf or adding an action.email.reportFileName line to the saved search itself is changing the name of the file. Is there a workaround for Splunk 9?

[Gr0und_Z3r0]

Hi @landrujw 

One way to do it would be, in the search set the current time in whichever format you want in a field.
And use this field in the report name. Something like this "$name$ - $myReportTime$"


~ If the reply helps, a Karma upvote would be appreciated.