https://community.splunk.com/t5/Alerting/passing-arguments-to-shell-script-alert-action/m-p/320619#M11015 <P>Hello,</P> <P>I have an alert which results a host name and task name whenever certain task goes down on the servers. I want to run a script(.sh) alert action in Splunk web based on this triggered alert, where that script would reset the status of that task to running. In doing so, I had to pass host name and task name as parameters to the shell script. I already have a script but have to pass parameters to it. How would I pass those particular parameters to that script? Detailed explanation would be kind enough. An example for this kind of script with parameters would be appreciated</P> <P>Thanks</P> Tue, 05 Dec 2017 16:32:55 GMT kumar28 2017-12-05T16:32:55Z https://community.splunk.com/t5/Alerting/passing-arguments-to-shell-script-alert-action/m-p/320619#M11015 <P>Hello,</P> <P>I have an alert which results a host name and task name whenever certain task goes down on the servers. I want to run a script(.sh) alert action in Splunk web based on this triggered alert, where that script would reset the status of that task to running. In doing so, I had to pass host name and task name as parameters to the shell script. I already have a script but have to pass parameters to it. How would I pass those particular parameters to that script? Detailed explanation would be kind enough. An example for this kind of script with parameters would be appreciated</P> <P>Thanks</P> Tue, 05 Dec 2017 16:32:55 GMT https://community.splunk.com/t5/Alerting/passing-arguments-to-shell-script-alert-action/m-p/320619#M11015 kumar28 2017-12-05T16:32:55Z https://community.splunk.com/t5/Alerting/passing-arguments-to-shell-script-alert-action/m-p/320620#M11016 <P>Hi @kumar28,</P> <P>If you are using "Run a script" (alert action) then this feature has been deprecated since Splunk 6.3 and splunk introduced new feature <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/AdvancedDev/ModAlertsIntro">Custom Alert Action</A> but "Run a script" (alert action) is still working.</P> <P>If you want to fetch parameter for "alert action" then please refer <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Configuringscriptedalerts">http://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Configuringscriptedalerts</A> </P> <P>Based on the documentation <CODE>$SPLUNK_ARG_8</CODE> gives you filename with full path in which query result will be stored, it will be compressed (.gz) CSV file. Once you have this file you can <CODE>zcat</CODE> command in linux to read content from compressed CSV file and you can implement your logic to read every row and required column value from that file.</P> <P>If you are trying to implement "Custom Alert Action" then you can use <CODE>read payload</CODE> in your script to fetch payload value and from that payload you will able to find <CODE>results_file</CODE> parameter which gives you filename with full path in which query result will be stored, it will be compressed (.gz) CSV file and then you can perform same logic which I explained above in "alert script".</P> <P>I hope this helps.</P> <P>Thanks,<BR /> Harshil</P> Wed, 06 Dec 2017 03:21:11 GMT https://community.splunk.com/t5/Alerting/passing-arguments-to-shell-script-alert-action/m-p/320620#M11016 harsmarvania57 2017-12-06T03:21:11Z