Alerting

How to change name of attachments in email alert action in Splunk 6.3?

Melnikovin
Engager

Hi.

In Splunk 6.2 in alerts with email action, all CSV Attachments have a name like "splunk_results.csv" by default. After installation of 6.3, the default name was changed to $name$ token(name of alert).
If I use Russian language in the alert name, I got something like this in half of cases:
"п║п©п╦я│п╬п╨п╫п╬п╡я▀я┘я┐я│я┌п╟п╫п╬п╡п╬п╨_п╥п╟п©я-2015-10-20.csv"

So how can I rename the name of the attached CSV file?

0 Karma

stephane_cyrill
Builder

Hi, you can modify the default splunk python script, as this is the script that actually send the emails. It resides in:
$SPLUNK_HOME/etc/apps/search/bin/sendemail.py . To rename the attached csv name , rename the default filename (
filename = "splunk-results.csv")
I advice you to see this:

https://answers.splunk.com/answers/2641/how-do-i-customize-scheduled-search-alert-emails.html

0 Karma

Melnikovin
Engager

Thank you. I wiil try.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...