I am looking for a way to modify the default CSV name "splunk-results.csv" in version 6.2.1. I need the CSV attachments to be named "$searchname.csv" so I can email them to SharePoint and have the files be identifiable by name.
In older versions of Splunk before 6.0.1 I was able to modify ($splunk_home/etc/apps/search/bin/sendemail.py) but the script changed in one of the more recent versions and I am unable to make it work now.
Greatly appreciate any advice you can offer!
Use the filename arguement.
Description: Specify the name of a csv file to write the search results. This file should be located in $SPLUNK_HOME/var/run/splunk. If no filename specified, rewrites the contents of each result as a CSV row into the "_xml" field. Otherwise writes into a file (appends ".csv" to filename if filename has no existing extension).