I need to change the format of the name of the .csv attachments on reports from my organization's saved searches. I've gone through the older solutions but they don't seem to be valid anymore. The goal is when a report sends an email with a .csv attachment to have the timestamp be "$name$-$time:%Y-%m-%d-%H:%M:%S$" instead of just "$name$-$time:%Y-%m-%d". Neither setting the reportFileName in alert_actions.conf or adding an action.email.reportFileName line to the saved search itself is changing the name of the file. Is there a workaround for Splunk 9? ... View more