topic Passing a custom string from alert into a script (Python or bash) in Alerting

Passing a custom string from alert into a script (Python or bash)

moin3949 — Thu, 03 Feb 2022 03:49:36 GMT

I am pretty new to Splunk and trying to figure out how alert notification and adding a script to it works.

My alert will basically return a line from a log stream every time it matches my search criteria, which will be something like this"

process completed for config some_name having RUN_ID 1129 (it could be multiple lines)

my goal is to get the "config_name" part from here and send it as a column name into a sql query that either I put it in a bash or python script:

select "config_name" from table;

how are the alert result and the script connected? can someone bring an example? saw few posts (https://community.splunk.com/t5/Alerting/how-to-pass-custom-strings-from-a-Splunk-Alert-into-a-python/m-p/322664) but not quite getting it....

any help would be appreciate it!

PickleRick — Thu, 03 Feb 2022 06:59:45 GMT

Especially the logger.py example.

As a side note - you should never rely on user supplied data like this - don't name the databse query column after a search field.

moin3949 — Thu, 03 Feb 2022 14:58:34 GMT

This doesn't answer my question .this is writing the alert into a log file which is not my intention ...

I want to grab a keyword from the returned string(alert result ) and send it to my custom string.