topic Re: Scripted Alert Parameters in a Search Query Using runshellscript in Alerting

Scripted Alert Parameters in a Search Query Using runshellscript

greich — Mon, 28 Sep 2020 15:34:17 GMT

| head 1 | addinfo | runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated $search_id$

works until the last parameter. The output is:

'/opt/splunk/bin/scripts/echo.sh' 'DummyEventNumber' 'DummySearchTerms' 'DummyFullQuery' 'DummySearchName' 'DummyReason' 'DummyURL' 'Deprecated' '/opt/splunk/var/run/splunk/dispatch/$search_id$/results.csv.gz' ''

My real script processes the results, so I need to retrieve the search_id (or addinfo | info_sid) to construct the path. Any idea how to materialise the value instead of passing the variable name?

Re: Scripted Alert Parameters in a Search Query Using runshellscript

alacercogitatus — Fri, 03 Jan 2014 14:35:01 GMT

You can try a map, since you have a single event result.

| head 1 | addinfo | map search=" runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated /opt/splunk/var/run/splunk/dispatch/$info_sid$/results.csv.gz"

Re: Scripted Alert Parameters in a Search Query Using runshellscript

greich — Mon, 28 Sep 2020 15:34:25 GMT

using this with $search_id$ leads to:
Error in 'map': Did not find value for required attribute 'search_id'.
and using $info_sid$, it seems to work, but doesn't retrieve the correct search id and the script fails with: ERROR|2014-01-03 15:01:27,063 - exception =[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/1388761284.347923/results.csv.gz'
if I execute the first part and copy the search id, then paste it manually in the runshellscript parameters, it works fully, but not with the map.

Re: Scripted Alert Parameters in a Search Query Using runshellscript

alacercogitatus — Fri, 03 Jan 2014 15:13:13 GMT

The info_sid is correct. If there are events, the file should be there. If no events, the file won't exist, which may cause that error. Did you confirm the file exists manually? Also, this is unsupported by Splunk. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Runshellscript