Modify CSV attachment name when emailed

[zindain24]

I am looking for a way to modify the default CSV name "splunk-results.csv" in version 6.2.1. I need the CSV attachments to be named "$searchname.csv" so I can email them to SharePoint and have the files be identifiable by name.

In older versions of Splunk before 6.0.1 I was able to modify ($splunk_home/etc/apps/search/bin/sendemail.py) but the script changed in one of the more recent versions and I am unable to make it work now.

Greatly appreciate any advice you can offer!

[markthompson]

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Outputcsv

Take a look there, you can specify the filename

[zindain24]

Thanks for your comments Mark, although this command doesn't appear to change the CSV name when emailed.

Any other thoughts?

[ben_leung]

I also want to know if there is a way to modify the CSV name when emailed.

[markthompson]

Use the filename arguement.
Syntax: <filename>
Description: Specify the name of a csv file to write the search results. This file should be located in $SPLUNK_HOME/var/run/splunk. If no filename specified, rewrites the contents of each result as a CSV row into the "_xml" field. Otherwise writes into a file (appends ".csv" to filename if filename has no existing extension).