- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Configure scripted alerts with savedsearches.conf. Use the $SPLUNK_HOME/etc/system/README/savedsearches.conf.example as an example, or create your own savedsearches.conf.
Complete documentation on the subject can be found here: http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Configuringscriptedalerts
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

To send non-fixed information to an alert, you must write your alert script to open the results file. The results file path is by default is argument number 8, and is in CSV format. Your script can open and parse out results from this file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
and where is that file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first answer shows how to create alerts, not how to have the scripted alert pass in event arguments. i.e. hostname, message, etc. Splunk appears to pass in the 8 arguments in the documentation, but doesn't allow you to include additional information.
If I have an alert that is trigger, and part of the search that triggers the alert is host="MYMACHINE*", it would be great to know in the alert which MYMACHINE# the alert was found on. Is there a way to do that?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Configure scripted alerts with savedsearches.conf. Use the $SPLUNK_HOME/etc/system/README/savedsearches.conf.example as an example, or create your own savedsearches.conf.
Complete documentation on the subject can be found here: http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Configuringscriptedalerts
