<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic External Lookup not passing argument contents to script in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/External-Lookup-not-passing-argument-contents-to-script/m-p/423612#M100228</link>
    <description>&lt;P&gt;I have a external lookup that is not passing the search argument data to the script driving the lookup.  &lt;/P&gt;

&lt;P&gt;Here is my transform.conf:&lt;/P&gt;

&lt;P&gt;[NotificationData1]&lt;BR /&gt;
external_cmd = NotificationData.bat Notification&lt;BR /&gt;
external_type = executable&lt;BR /&gt;
fields_list = Notification, Notes, Summary, Severity, ClassName, InstanceName, EventName, EventText&lt;/P&gt;

&lt;P&gt;I created a wrapper script which is the executable for the lookup:&lt;/P&gt;

&lt;P&gt;set arg1=%1&lt;BR /&gt;
D:\InCharge\CONSOLE\smarts\bin\sm_perl.exe HelloWorld.pl %arg1%&lt;/P&gt;

&lt;P&gt;The search which drives this is passing one argument, Notification.  This argument is a field from the search output:&lt;/P&gt;

&lt;P&gt;| stats count&lt;BR /&gt;
| eval Notification="NOTIFICATION-VoltageSensor_&lt;EM&gt;Fault&lt;/EM&gt;&lt;EM&gt;PowerSupply210&lt;/EM&gt;&lt;EM&gt;CiscoUCSChassis_I-VoltageSensor&lt;/EM&gt;&lt;EM&gt;Fault&lt;/EM&gt;&lt;EM&gt;PowerSupply210&lt;/EM&gt;_CiscoUCSChassis-VOLT-BEM-10.7.15.5[ALBISC02CR-N4R3-FAB]/2/3356137/Chassis-2/Psu-4/210V_OutOfRange"&lt;BR /&gt;
| table Notification&lt;BR /&gt;
| lookup NotificationData1 Notification&lt;/P&gt;

&lt;P&gt;My script is a perl program which I have defined logging to give me various messages as the script progresses.  One of my first messages is to display the Notification argument from the lookup command.  &lt;/P&gt;

&lt;P&gt;No such luck.  The perl script is reporting that I am getting them NAME of the argument, Notification not the value.  &lt;/P&gt;

&lt;P&gt;What could be the problem?  &lt;/P&gt;

&lt;P&gt;Any help at this point would be appreciated.&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 23:34:53 GMT</pubDate>
    <dc:creator>chartin</dc:creator>
    <dc:date>2020-09-29T23:34:53Z</dc:date>
    <item>
      <title>External Lookup not passing argument contents to script</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/External-Lookup-not-passing-argument-contents-to-script/m-p/423612#M100228</link>
      <description>&lt;P&gt;I have a external lookup that is not passing the search argument data to the script driving the lookup.  &lt;/P&gt;

&lt;P&gt;Here is my transform.conf:&lt;/P&gt;

&lt;P&gt;[NotificationData1]&lt;BR /&gt;
external_cmd = NotificationData.bat Notification&lt;BR /&gt;
external_type = executable&lt;BR /&gt;
fields_list = Notification, Notes, Summary, Severity, ClassName, InstanceName, EventName, EventText&lt;/P&gt;

&lt;P&gt;I created a wrapper script which is the executable for the lookup:&lt;/P&gt;

&lt;P&gt;set arg1=%1&lt;BR /&gt;
D:\InCharge\CONSOLE\smarts\bin\sm_perl.exe HelloWorld.pl %arg1%&lt;/P&gt;

&lt;P&gt;The search which drives this is passing one argument, Notification.  This argument is a field from the search output:&lt;/P&gt;

&lt;P&gt;| stats count&lt;BR /&gt;
| eval Notification="NOTIFICATION-VoltageSensor_&lt;EM&gt;Fault&lt;/EM&gt;&lt;EM&gt;PowerSupply210&lt;/EM&gt;&lt;EM&gt;CiscoUCSChassis_I-VoltageSensor&lt;/EM&gt;&lt;EM&gt;Fault&lt;/EM&gt;&lt;EM&gt;PowerSupply210&lt;/EM&gt;_CiscoUCSChassis-VOLT-BEM-10.7.15.5[ALBISC02CR-N4R3-FAB]/2/3356137/Chassis-2/Psu-4/210V_OutOfRange"&lt;BR /&gt;
| table Notification&lt;BR /&gt;
| lookup NotificationData1 Notification&lt;/P&gt;

&lt;P&gt;My script is a perl program which I have defined logging to give me various messages as the script progresses.  One of my first messages is to display the Notification argument from the lookup command.  &lt;/P&gt;

&lt;P&gt;No such luck.  The perl script is reporting that I am getting them NAME of the argument, Notification not the value.  &lt;/P&gt;

&lt;P&gt;What could be the problem?  &lt;/P&gt;

&lt;P&gt;Any help at this point would be appreciated.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 23:34:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/External-Lookup-not-passing-argument-contents-to-script/m-p/423612#M100228</guid>
      <dc:creator>chartin</dc:creator>
      <dc:date>2020-09-29T23:34:53Z</dc:date>
    </item>
  </channel>
</rss>

