topic Splunk Alerting : How to pass arguments/filename to your script? in Reporting

Splunk Alerting : How to pass arguments/filename to your script?

koshyk — Mon, 28 Sep 2020 16:37:19 GMT

Hi
I have savedSearch which should alert every 1 min. The searchname is "myApp_Alert_1m" and the file produced is "myApp_Alert_1m.csv". My Script is kept in $SPLUNK_HOME/bin/scripts/myAlert.py
So my SavedSearch outputs this file

 .. | outputcsv myApp_Alert_1m

How can I pass this filename as a parameter into "myAlert.py"?

( I tried putting into Enable Script where it shows "File name of shell script to run" with option, but not getting any output. )

Re: Splunk Alerting : How to pass arguments/filename to your script?

koshyk — Mon, 28 Sep 2020 16:37:41 GMT

Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.

Within the script it would be:

CSV_FILE_IN                =    sys.argv[4] + '.csv'
COUNT_ALERTS               =    sys.argv[1]

Re: Splunk Alerting : How to pass arguments/filename to your script?

patelmc — Sun, 07 Feb 2021 18:18:56 GMT

How can we use this variable SPLUNK_ARG_4 inside bash shell?

Is it possible to pass this variable as $i with the script?