topic Re: Splunk search results in Splunk Dev

Splunk search results

ashvini_jain — Fri, 12 Jun 2020 04:56:26 GMT

Hi
I recently started using splunk in my company. Being new to it, I don't know much at the back end of the splunk. I want to know how can we get search results to feed in the python script via alert action -> run script.
Pointing towards useful documentation also would be helpful.

Re: Splunk search results

p_gurav — Fri, 12 Jun 2020 05:46:19 GMT

Hi Ashvini,

Here is the Splunk document which you can refer to, they also give some examples which will help to understand better.

https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/CustomAlertConvertScripted

Re: Splunk search results

livehybrid — Fri, 12 Jun 2020 07:50:51 GMT

Hi @ashvini_jain

There is some useful documentation here https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsBasicExample which might help with what you're looking for. Custom alerts use stdin to take in the results and can then be parsed and acted upon.

I hope this helps.