Splunk Search

Set the name of pdf document with pdfserver

krusty
Contributor

Hi there,

is it possible to set the name of the attached pdf document?
Usually the attached file was named by "splunk-report.pdf".
In my case I have to set the name individually.

For example: splunk_windows_errors_20120110.pdf

For you information. I have the problem that i have to store the attached files from splunk to our fileserver. If every attachment has the same name I got problems to handle it.

I store the files with the tool ripmime. Which is a fantastic tool.

Has anyone an idea how to set the filename of the attached file?

Regards

Tags (1)

krusty
Contributor

I have searched the splunk board and find this thread.
change filename of pdf

As you can read they modify the sendemail.py code to change the filename of the pdf document.

I have made some changes but the filenames are only 30 characters long.
Have anyone changed the sendemail.py too and get more than 30 characters in the filename?

The pdf files look like this:

20120113_113008_st_search.pdf
20120113_113007_srv060.pdf

The first pdf is wrong. The filename should look like 20120113_113008_test_search.pdf.
The second one is fine.

Here are the changes I've made.

    pdfviewfn = pdfview and pdfview.strip(' .:;|><\'"')
    filepart = subject and subject.strip('Splunk Alert: ')
#    logger.info('pdfview=%s pdfviewfn=%s subject=%s filepart=%s' % (pdfview, pdfviewfn, subject, filepart))
#    logger.debug('pdfview=%s pdfviewfn=%s' % (pdfview, pdfviewfn))

    datestamp = time.strftime('%Y-%m-%d')
    datecomplete = time.strftime("%Y%m%d_%H%M%S")

    if pdfviewfn:
        filename = '%s_%s.pdf' % (datecomplete, filepart)
#        filename = '%s-%s.pdf' % (pdfviewfn[:50], datestamp)

        # strip control characters, forward & backslash
        filename = re.sub(r'[\x00-\x1f\x7f/\\]+', '-', filename)
        if isinstance(filename, unicode):
            filename = ('utf-8', '', filename.encode('utf-8'))
    else:
        filename = '%s_%s.pdf' % (datecomplete, filepart)
#        filename = 'splunk-report-%s.pdf' % datestamp
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...