Alerting
Highlighted

Is it possible to pass the query of an alert to a script?

Communicator

Is it possible to pass the query of an alert to a script? I want to trigger a script via alert and at the same time I want to pass the query of the alert to the said script. Is this possible? can someone give me hints / ideas on how to do this, thanks in advance 🙂

0 Karma
Highlighted

Re: Is it possible to pass the query of an alert to a script?

SplunkTrust
SplunkTrust

Hi,

If you are using Custom Alert Action to fire script in your alert in that case you can use param.search_query = $search$ in alertactions.conf which will provide search query in payload with parameter `searchquery`

0 Karma
Highlighted

Re: Is it possible to pass the query of an alert to a script?

hi @mjlsnombrado

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma