topic Re: Python alert script to show the search result values in Splunk Search

Python alert script to show the search result values

harish_ka — Thu, 26 Nov 2015 17:13:36 GMT

Can someone please help me with a python script to display the values of search results.
i have been trying but not able to write a script for this.
Do we need to do any other settings??

Re: Python alert script to show the search result values

dart — Thu, 26 Nov 2015 17:21:41 GMT

Can you elaborate on what your final goal is here? Are you using Splunk 6.3 or an earlier release?

Re: Python alert script to show the search result values

harish_ka — Thu, 26 Nov 2015 17:31:51 GMT

i need to print (to a file) the search results when the alert is triggered, lets say i have 3 columns in the search results, i need to send the result values of these 3 columns to another file .

I am now trying in 6.3 version (trial version), but i will be implementing in 6.2 version. Is there any changes in scripts or functionalities when we use latest version of splunk??

Re: Python alert script to show the search result values

jplumsdaine22 — Fri, 27 Nov 2015 12:14:58 GMT

If you want to run a script from a saved search, check out:
http://docs.splunk.com/Documentation/Splunk/6.3.1/alert/ConfiguringScriptedAlerts

You'll need to parse out the results from a file, the filename is provided as the 9th argument to the script.

Re: Python alert script to show the search result values

harish_ka — Tue, 29 Sep 2020 08:00:17 GMT

Yes i am trying with the following script:

!C:/Program Files/Splunk/bin/python

import sys, csv

def openany(p):

if  p.endswith(".gz"):
    import gzip
    return gzip.open(p)

else:
    return open(p)

results_file = sys.argv[9]
for result in csv.DictReader(openany(results_file)):

Do whatever action with your results ...

print results["_raw"]

But its not working 😞

Can you help me with this??

Re: Python alert script to show the search result values

jplumsdaine22 — Fri, 27 Nov 2015 13:42:18 GMT

Test your script first.

Run your script manually against any results.csv.gz file (you can find them in $SPLUNK_HOME/var/run/splunk/dispatch/ )

eg
python pyalert.py 0 1 2 3 4 5 6 7 ./results.csv.gz

You should get a stacktrace from python telling you whats going wrong. I can't tell you 100% from looking at your code but I'm guessing you're missing an indent in the final for loop, and 'results' is not defined anywhere

This might work better:

for result in csv.DictReader(openany(results_file)):
           print result

Re: Python alert script to show the search result values

jeffland — Mon, 30 Nov 2015 14:22:57 GMT

@jplumsdaine22, you can format your text almost any way you like when you use the code mode:

leave one line blank and indent by four spaces
  and then
                             you can indent as much as you like
                             and have monospaced font

Re: Python alert script to show the search result values

harish_ka — Fri, 04 Dec 2015 06:08:48 GMT

Yes it worked 🙂
Thanks a lot @jplumsdaine22 & @jeffland