Splunk Enterprise

Disable date stamp from the report

iamsplunker
Explorer

Hello Splunkers, 

I have a report (apple_weekly_report) which runs every week and I receive an email of the report. Now the issue is the date stamp is auto appending to my report name (apple_weekly_report-2020-09-01.csv) but I do not want the date stamp appended. I just need apple_weekly_report.csv as my report name. Is there any way to disable this date stamp.

Thank you

Labels (2)
0 Karma
1 Solution

Nisha18789
Builder

Hi @iamsplunker , you can do this by navigating to the "Advanced Edit" for your report , and find this field : action.email.reportFileName and remove the date part to get rid of date stamp in the report name.

Attached is a screenshot for reference.

Hope this helps!removingdate.png

 

View solution in original post

0 Karma

Nisha18789
Builder

Hi @iamsplunker , you can do this by navigating to the "Advanced Edit" for your report , and find this field : action.email.reportFileName and remove the date part to get rid of date stamp in the report name.

Attached is a screenshot for reference.

Hope this helps!removingdate.png

 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you post your report spl?
0 Karma

iamsplunker
Explorer

Hi  @isoutamo 

I believe the date stamp will be auto-appended for every Report/Alert in Splunk If we choose to deliver the Report as Email. Wondering If we have any option to disable the date stamp in the report name (attachment name in the email) ?  Thanks

Here is the query 

index=abc source="Daily Errors" earliest=-1w@w3 latest=@w3 | table AppName ReportName Errors Variance

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!