Splunk Search

Set the name of pdf document with pdfserver

krusty
Contributor

Hi there,

is it possible to set the name of the attached pdf document?
Usually the attached file was named by "splunk-report.pdf".
In my case I have to set the name individually.

For example: splunk_windows_errors_20120110.pdf

For you information. I have the problem that i have to store the attached files from splunk to our fileserver. If every attachment has the same name I got problems to handle it.

I store the files with the tool ripmime. Which is a fantastic tool.

Has anyone an idea how to set the filename of the attached file?

Regards

Tags (1)

krusty
Contributor

I have searched the splunk board and find this thread.
change filename of pdf

As you can read they modify the sendemail.py code to change the filename of the pdf document.

I have made some changes but the filenames are only 30 characters long.
Have anyone changed the sendemail.py too and get more than 30 characters in the filename?

The pdf files look like this:

20120113_113008_st_search.pdf
20120113_113007_srv060.pdf

The first pdf is wrong. The filename should look like 20120113_113008_test_search.pdf.
The second one is fine.

Here are the changes I've made.

    pdfviewfn = pdfview and pdfview.strip(' .:;|><\'"')
    filepart = subject and subject.strip('Splunk Alert: ')
#    logger.info('pdfview=%s pdfviewfn=%s subject=%s filepart=%s' % (pdfview, pdfviewfn, subject, filepart))
#    logger.debug('pdfview=%s pdfviewfn=%s' % (pdfview, pdfviewfn))

    datestamp = time.strftime('%Y-%m-%d')
    datecomplete = time.strftime("%Y%m%d_%H%M%S")

    if pdfviewfn:
        filename = '%s_%s.pdf' % (datecomplete, filepart)
#        filename = '%s-%s.pdf' % (pdfviewfn[:50], datestamp)

        # strip control characters, forward & backslash
        filename = re.sub(r'[\x00-\x1f\x7f/\\]+', '-', filename)
        if isinstance(filename, unicode):
            filename = ('utf-8', '', filename.encode('utf-8'))
    else:
        filename = '%s_%s.pdf' % (datecomplete, filepart)
#        filename = 'splunk-report-%s.pdf' % datestamp
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...