How to run an alert script on field values generated in Splunk?

Path Finder


I have an alert that calls a script when invoked.

The result have the 1st column as ip address [host]. I want the script to run on all IP addresses in the result.

Because host is a field generated by default in Splunk. What's the best way to call a script?

Is something like :

myscript $Host

or whatever that argument is for ip address is, possible?

Super Champion

So you can't directly call your script with an argument the way you described above, but you can get pretty close with a simple wrapper script.

Here is something you could get started with:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return open(p)

results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "myscript", row["host"], ]

This script will execute myscript <HOST> for every result returned by your search.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...