topic Re: How can we execute a script that uses fields from a message? in Getting Data In

How can we execute a script that uses fields from a message?

thsvinayb4u — Mon, 04 Dec 2017 21:03:56 GMT

Hello,

We usually get hundreds of logs and we want to execute scripts based on those logs. The key takeaway here is when Splunk scans a log file based on a message like "THIS JOB XXYYZZ" IS DOWN on server ABC" I want to execute a script passing XXYYZZ ABC as arguments.

Note: JOB name and server name changes.

Re: How can we execute a script that uses fields from a message?

MuS — Mon, 04 Dec 2017 21:33:40 GMT

Hi thsvinayb4u,

you are looking for custom alert action; find the docs here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsIntro

All you need to know about passing tokens to your alert script can be found here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsLog

Hope this helps to get you started ...

cheers, MuS

Re: How can we execute a script that uses fields from a message?

woodcock — Mon, 04 Dec 2017 23:28:24 GMT

Like this:

| makeresults
| eval _raw="THIS JOB XXYYZZ" IS DOWN on server ABC"
| rex "JOB\s+(?<job>\S+)\s+IS\s+(?<state>\S+)\s+on\s+server\s+(?<server>\S+)"

| rename COMMENT AS "Everything above is generating sample event data; everything below is your solution"

| map search="| makeresults | YourScriptHere $job$ $server$"