topic How do I get the parameters passed to the batch script in an alert action? in Alerting

How do I get the parameters passed to the batch script in an alert action?

axl88 — Wed, 08 Jun 2016 21:05:44 GMT

I have a .bat script that calls a Powershell script as an alert action. I am trying to make my batch script re-usable with different parameters from Alert actions.

My batch script is like:

@echo off
set psdir=E:\Temp\%1
E:
@powershell %psdir%

When I run the batch script from CMD with parameters, I have no issues, PS runs great and it does what it needs to do.
If I hard code the PS path and run BAT as an alert action without parameters, it works as well.

When I try to run it from Alert actions with parameters, it fails. My bat file is located in Splunk_Home\bin\scripts
Alert action is like:

mybat.bat myps1.ps1

Thanks up front for your time and help.

Re: How do I get the parameters passed to the batch script in an alert action?

Masa — Wed, 08 Jun 2016 21:54:37 GMT

You should avoid such solution using an argument for post script alert. Splunk will pass required arguments. Maybe your batch script can decided which powershell script to run based on saved search name passed from Splunk.

Re: How do I get the parameters passed to the batch script in an alert action?

axl88 — Wed, 08 Jun 2016 22:32:21 GMT

Thanks for the response. Reason I came up with this solution is to add/remove PS scripts without Splunk server intervention. I just want to use UI setup for alerts going forward and keep my PS scripts somewhere that Splunk server can access.
I was wondering if "\" (backslashes) of the path might be the problem for Splunk. Can I escape them as regex?

Re: How do I get the parameters passed to the batch script in an alert action?

Masa — Wed, 08 Jun 2016 22:47:36 GMT

Your idea itself sounds good.
Sorry but the UI input for post script is to check executable file (script) in a proper location. So, you need to avoid argument in the Alert action script field.

Re: How do I get the parameters passed to the batch script in an alert action?

axl88 — Thu, 09 Jun 2016 16:04:05 GMT

ok, this question might be unrelated to what i ask, but do you know if there is anyway to run a saved search as alert action like post script?

Re: How do I get the parameters passed to the batch script in an alert action?

Masa — Tue, 29 Sep 2020 09:55:57 GMT

( ref: https://answers.splunk.com/answers/2378/running-a-saved-search-from-the-command-line-interface-cli.html )

In a script, run a Splunk search,
$SPLUNK_HOME/bin/splunk search '| savedsearch "$saved_search_name$" -app $my_app_name$' -auth admin:changeme

Re: How do I get the parameters passed to the batch script in an alert action?

axl88 — Thu, 09 Jun 2016 17:18:20 GMT

Thanks man