Hi at all,
I have a (probably) very stupid question: I have to send alerts to an external system (IBM NetCool) using SNMP traps.
I configured an alert to run a perl script to do this and runs.
My question is: Splunk passes to the script eight parameters:
but I don't see the search results (events that triggered my alert).
How can I pass to NetCool these results?
Maybe NetCool must connect to Splunk to the link of $ARGV ?
It isn't so functional! probably there is another way!
In addition I see that parameters $ARGV and $ARGV give the same value (alert search).
Why not just have your script read the $ARGV and send the results? I would also suggest building this as an alert action similar to splunk-add-on-jira-alerts which does things similarly. Also alert actions are first class citizens in Splunk.
Thank you bmacias84,
I did something like you suggested:
in my script I take the tgz file containing results, I explode it and I send results in the 8th field.