https://community.splunk.com/t5/Alerting/How-do-I-get-some-missing-parameters-from-JSON-payload-to-a/m-p/266933#M4905 <P>Firstly I am very new to Splunk app development. I'm trying to create a custom alert application and I'm having problems with getting some of the info on the detected condition from the json payload available to the script.</P> <P>If I was using a regular script action, I would have access to the following arguments passed to the script:</P> <P>0 = Script name<BR /> 1 = Number of events returned<BR /> 2 = Search terms<BR /> 3 = Fully qualified query string<BR /> 4 = Name of report<BR /> 5 = Trigger reason (i.e. "The number of events was greater than 1")<BR /> 6 = Browser URL to view the report<BR /> 7 = This option has been deprecated and is no longer used<BR /> 8 = File where the results for this search are stored (contains raw results)</P> <P>When using a custom alert app, these don't seem to apply and you get the data via reading stdin. I am using the json format and some of the above are in fact included in the json payload, however, I don't see any key that relates to trigger reason or number of events returned.</P> <P>How do I get access to those two specific pieces of information from the script being invoked from the custom alert app?</P> <P>Thanks.</P> Thu, 31 Mar 2016 18:05:15 GMT isfleming 2016-03-31T18:05:15Z https://community.splunk.com/t5/Alerting/How-do-I-get-some-missing-parameters-from-JSON-payload-to-a/m-p/266933#M4905 <P>Firstly I am very new to Splunk app development. I'm trying to create a custom alert application and I'm having problems with getting some of the info on the detected condition from the json payload available to the script.</P> <P>If I was using a regular script action, I would have access to the following arguments passed to the script:</P> <P>0 = Script name<BR /> 1 = Number of events returned<BR /> 2 = Search terms<BR /> 3 = Fully qualified query string<BR /> 4 = Name of report<BR /> 5 = Trigger reason (i.e. "The number of events was greater than 1")<BR /> 6 = Browser URL to view the report<BR /> 7 = This option has been deprecated and is no longer used<BR /> 8 = File where the results for this search are stored (contains raw results)</P> <P>When using a custom alert app, these don't seem to apply and you get the data via reading stdin. I am using the json format and some of the above are in fact included in the json payload, however, I don't see any key that relates to trigger reason or number of events returned.</P> <P>How do I get access to those two specific pieces of information from the script being invoked from the custom alert app?</P> <P>Thanks.</P> Thu, 31 Mar 2016 18:05:15 GMT https://community.splunk.com/t5/Alerting/How-do-I-get-some-missing-parameters-from-JSON-payload-to-a/m-p/266933#M4905 isfleming 2016-03-31T18:05:15Z https://community.splunk.com/t5/Alerting/How-do-I-get-some-missing-parameters-from-JSON-payload-to-a/m-p/266934#M4906 <P>Many thanks to Siegfried Puchbauer @ziegfried for the following...</P> <P>For simple trigger conditions:<BR /> • $counttype$ type selected in the dropdown - eg. “number of events”<BR /> • $relation$ comparator selected in the dropdown - eg. “greater than”<BR /> • $quantity$ the numeric threshold - eg. “1000”</P> <P>If a custom trigger condition was specified you can use $alert_condition$, which will contain the SPL-based trigger condition.</P> <P>It would be reasonable to create a custom param in alert_actions.conf to pass this information to your alert script</P> Fri, 08 Apr 2016 19:00:15 GMT https://community.splunk.com/t5/Alerting/How-do-I-get-some-missing-parameters-from-JSON-payload-to-a/m-p/266934#M4906 isfleming 2016-04-08T19:00:15Z