Getting Data In

Modify CSV attachment name when emailed

zindain24
Path Finder

I am looking for a way to modify the default CSV name "splunk-results.csv" in version 6.2.1. I need the CSV attachments to be named "$searchname.csv" so I can email them to SharePoint and have the files be identifiable by name.

In older versions of Splunk before 6.0.1 I was able to modify ($splunk_home/etc/apps/search/bin/sendemail.py) but the script changed in one of the more recent versions and I am unable to make it work now.

Greatly appreciate any advice you can offer!

Tags (2)
0 Karma

markthompson
Builder

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Outputcsv

Take a look there, you can specify the filename

0 Karma

zindain24
Path Finder

Thanks for your comments Mark, although this command doesn't appear to change the CSV name when emailed.

Any other thoughts?

0 Karma

ben_leung
Builder

I also want to know if there is a way to modify the CSV name when emailed.

0 Karma

markthompson
Builder

Use the filename arguement.
Syntax: <filename>
Description: Specify the name of a csv file to write the search results. This file should be located in $SPLUNK_HOME/var/run/splunk. If no filename specified, rewrites the contents of each result as a CSV row into the "_xml" field. Otherwise writes into a file (appends ".csv" to filename if filename has no existing extension).

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...