https://community.splunk.com/t5/Alerting/how-to-include-search-results-in-python-custom-alert-script/m-p/408932#M7186 <P>For <STRONG>Custom Alert Actions tokens</STRONG> you could use this guide:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tokens</A></P> <P>So in your case if you want to pass some <STRONG>field results</STRONG> (lets name it Results_To_Pass) and also the <STRONG>sid</STRONG> of the search, you could put it like this in the UI:</P> <PRE><CODE>Results: $results.Results_To_Pass$ Search Job: $job.sid$ </CODE></PRE> <P>Then the python script would parse this and perform its particular function.</P> <P>If you could provide more info it would be great.</P> <P>Hope it helps.</P> Wed, 30 Sep 2020 01:31:50 GMT jaime_ramirez 2020-09-30T01:31:50Z https://community.splunk.com/t5/Alerting/how-to-include-search-results-in-python-custom-alert-script/m-p/408931#M7185 <P>have a custom alert action scripts which have UI. If I give a fieldname in UI that needs to get value from search result and append to sid. How can I use $results.fieldnme$ or any other solution for this.</P> Mon, 29 Jul 2019 13:23:30 GMT https://community.splunk.com/t5/Alerting/how-to-include-search-results-in-python-custom-alert-script/m-p/408931#M7185 pranay_adla 2019-07-29T13:23:30Z https://community.splunk.com/t5/Alerting/how-to-include-search-results-in-python-custom-alert-script/m-p/408932#M7186 <P>For <STRONG>Custom Alert Actions tokens</STRONG> you could use this guide:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_values_to_alert_action_tokens</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tokens</A></P> <P>So in your case if you want to pass some <STRONG>field results</STRONG> (lets name it Results_To_Pass) and also the <STRONG>sid</STRONG> of the search, you could put it like this in the UI:</P> <PRE><CODE>Results: $results.Results_To_Pass$ Search Job: $job.sid$ </CODE></PRE> <P>Then the python script would parse this and perform its particular function.</P> <P>If you could provide more info it would be great.</P> <P>Hope it helps.</P> Wed, 30 Sep 2020 01:31:50 GMT https://community.splunk.com/t5/Alerting/how-to-include-search-results-in-python-custom-alert-script/m-p/408932#M7186 jaime_ramirez 2020-09-30T01:31:50Z