Alerting

Custom Alert: Get Result Count and Search Query

betamx
Observer

Hi, I'm new to creating custom alert action & I'm following the documentations provided by Splunk to create this. While I've got my alert to work, however I couldn't find a mechanism to inject the following two items to my application:

  • The number of items in the search result
  • The actual search query

In my use-case I need both of them & I'm not sure how to do that. I tried following another solved answer on similar lines but this hasn't helped me so far. Here's what I did in the savedsearches.conf.:

 

.....
.....
action.tmc.param.result_count = $job.resultCount$
action.tmc.param.search_query = $job.search$
.....
.....
.....

 

I've also defined the savedsearches.conf..spec file as follows:

.....
.....
action.tmc.param.result_count = <integer>
action.tmc.param.search_query = <string>
.....
.....
.....

However in my python script, when I print out the configuration sent out, I don't see these two arguments passed. I've restarted Splunk but that hasn't helped either.

I would really appreciate if someone can please help guide me to the right direction. Thanks! 

Labels (2)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>