Scripted Alert Parameters in a Search Query Using runshellscript

[greich]

• | head 1 | addinfo | runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated $search_id$

works until the last parameter. The output is:

'/opt/splunk/bin/scripts/echo.sh' 'DummyEventNumber' 'DummySearchTerms' 'DummyFullQuery' 'DummySearchName' 'DummyReason' 'DummyURL' 'Deprecated' '/opt/splunk/var/run/splunk/dispatch/$search_id$/results.csv.gz' ''

My real script processes the results, so I need to retrieve the search_id (or addinfo | info_sid) to construct the path. Any idea how to materialise the value instead of passing the variable name?

[alacercogitatus]

You can try a map, since you have a single event result.

| head 1 | addinfo | map search=" runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated /opt/splunk/var/run/splunk/dispatch/$info_sid$/results.csv.gz"

[alacercogitatus]

The info_sid is correct. If there are events, the file should be there. If no events, the file won't exist, which may cause that error. Did you confirm the file exists manually? Also, this is unsupported by Splunk. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Runshellscript

[greich]

using this with $search_id$ leads to:
Error in 'map': Did not find value for required attribute 'search_id'.
and using $info_sid$, it seems to work, but doesn't retrieve the correct search id and the script fails with: ERROR|2014-01-03 15:01:27,063 - exception =[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/1388761284.347923/results.csv.gz'
if I execute the first part and copy the search id, then paste it manually in the runshellscript parameters, it works fully, but not with the map.