Customize report

[ajayrejin]

Hi,

I have a requirement to customize the report generated in csv format, this is a scheduled report.
The report in .csv must have two sheets. First sheet should have splunk logo and time frame the report is for.
Second sheet should contain report name and the data .

Is there any way i customize the csv to include the above.

Thanks,
Ajay

[efavreau]

You can not customize it in Splunk. You would need to do it manually every time.
Further, when you discuss "sheets", that's an Excel/spreadsheet concept, not a csv concept.

[ajayrejin]

Okay. Can i use custom token in the email header of the report to show the month for which the report is run.
like use eval to create a custom field and use that field in the email header.

[efavreau]

Not exactly. However, in the docs, there's a list of variables that can be used:
https://docs.splunk.com/Documentation/Splunk/Latest/Alert/EmailNotificationTokens

You could edit some conf files to create a new variable. Or you might be able to find something you can use with $job.latestTime$ or $result.fieldname$