How to integrate Python script with Splunk (input, output)

[manuelag]

I have a Splunk alert which returns some JSON results as well as the usual Splunk fields and sends them by email to several recipients.

The results are not so readable by humans, so I have created a Python script to beautify them so they keep only the strictly necessary information and present it to the users in a neat way.

I know that I can pass a Python script in an alert configuration, however I'm not sure how the Python script can get the input values (the JSONs from the alert) nor what format to use for the output so it replaces the old JSONs in the emails.

My script calculates a priority score for each JSON in the email and I was wondering whether there was a way to include the highest score value in the subject of the email (I read about the variables, but couldn't find anything useful)...

Please advise.

[Yasaswy · Accepted solution]

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8']

eg:
import os
json_results = os.environ['SPLUNK_ARG_8']

Check out full details Here

However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition...