How to pass the username OR name of the savedsearch as parameters into the alert action itself?

[tzhang_gr]

Hi,

I have an alert action that triggers a python script;

In the intended workflow, this alert action can either
1. be manually executed by a user, or
2. be scheduled to execute as an alert action of several different alerts

How can I pass
1. the username that manually runs the search in case 1, and
2. the name of the alert that triggered this alert action

into the python script itself?

E.g. if user Alice@zzz.com runs

search xxx | sendalert alert_action_1

I want to use the variable "Alice@zzz.com" in the python script;

and if "Alert_ABC" triggers the action alert_action_1,
I want to use the variable "Alert_ABC" in the python script

I've got fields like "_raw" working, but couldn't find any parameters related to what/who triggered the alert action itself...

Any hints would be really appreciated!

[manjunathmeti · Accepted solution]

You need to create a custom alert action to run this script. You can read alert name and user from std input when custom alert action is triggered.

import sys

if __name__ == "__main__":
    if len(sys.argv) < 2 or sys.argv[1] != "--execute":
        print >> sys.stderr, "FATAL Unsupported execution mode (expected --execute flag)"
        sys.exit(1)
    try:
        settings = json.loads(sys.stdin.read())
        alert_name = settings['search_name']
        user = settings['user']
        .....
    except Exception, e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(0)

[tzhang_gr]

Ah thank you! I didn't realize I was only reading the columns of the ['results_file']....tyty!

[tzhang_gr]

@manjunathmeti Sorry to bother you again -

I've given it a try, but then noticed that my "search_name" attribute is always NULL, and I don't have a "user" attribute at all in the json object passed in from stdin - is there some additional settings I need to change?

Also tried passing in a param.name="$name$" when triggering sendalert but there's still no value...(however param.test="$app$" & "$owner$" worked, although they're giving the name of the app & "system" rather than username and alertname...)

Now I'm thinking using the action.. override in savedsearches,conf to hard code the alertname, but is there any way to figure out the username?

Thanks in advance!

[manjunathmeti]

Key "search_name" or u'search_name' or param.name="$name$" is available in the json payload only for scheduled alerts.

I am sorry 'user' doesn't exists in it but you can check if 'sid' or 'results_file' contain user name.

[tzhang_gr]

I see..I'll look around for the current user - thank you so much!