https://community.splunk.com/t5/Splunk-Search/how-to-change-result-of-alert-from-gzip-to-CSV/m-p/99148#M182652 <P>Hi All,<BR /> I have a problem. I create a scheduler search to retrieve a list of IP access to my web server exceeds a certain threadhold, there would be generate an alert. And now, I want create a script to get a list of IP and take to blacklist of firewall a way automatic. Can I write a script to get a list of IP from file result with format is gzip? Please help me solve problem?<BR /> Thanks &amp; regards,</P> Sat, 14 Jul 2012 07:55:45 GMT dungpv 2012-07-14T07:55:45Z https://community.splunk.com/t5/Splunk-Search/how-to-change-result-of-alert-from-gzip-to-CSV/m-p/99148#M182652 <P>Hi All,<BR /> I have a problem. I create a scheduler search to retrieve a list of IP access to my web server exceeds a certain threadhold, there would be generate an alert. And now, I want create a script to get a list of IP and take to blacklist of firewall a way automatic. Can I write a script to get a list of IP from file result with format is gzip? Please help me solve problem?<BR /> Thanks &amp; regards,</P> Sat, 14 Jul 2012 07:55:45 GMT https://community.splunk.com/t5/Splunk-Search/how-to-change-result-of-alert-from-gzip-to-CSV/m-p/99148#M182652 dungpv 2012-07-14T07:55:45Z https://community.splunk.com/t5/Splunk-Search/how-to-change-result-of-alert-from-gzip-to-CSV/m-p/99149#M182653 <P>Perhaps you should look at scripted alerts... <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/SetUpAlertActions#Run_a_script">here</A> </P> <P>There are couple of other question you should also look at for hints ... </P> <P><A href="http://splunk-base.splunk.com/answers/3019/scripted-alert-question">http://splunk-base.splunk.com/answers/3019/scripted-alert-question</A></P> <P>AND</P> <P><A href="http://splunk-base.splunk.com/answers/40843/alerting-send-ipuser-to-script-as-a-parameter">http://splunk-base.splunk.com/answers/40843/alerting-send-ipuser-to-script-as-a-parameter</A></P> <P>But generally you should also look to support/forums for your firewall vendor for the actual script sections that will be needed to add firewall rules to the access list.</P> <P>Hope this helps,</P> <P>MHibbin</P> Sat, 14 Jul 2012 10:26:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-change-result-of-alert-from-gzip-to-CSV/m-p/99149#M182653 MHibbin 2012-07-14T10:26:33Z