Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Re: output *results* in script
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
output *results* in script
We are using a Perl script to create tickets when a given event meets a certain threshold. How can we include the results of the search in the ticket? This seems like it should be pretty easy, but darned if I can figure out how to get at that data. Otherwise, all we have is a ticket with a link to the search we have to click on to get at the information we seek.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've found something interesting there...
https://github.com/georgestarcher/Splunk-Alert/blob/master/targetlist.py
http://www.georgestarcher.com/splunk-alert-scripts-automating-control/
The splunk doc is really missing some examples...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you had any luck with this? I am looking at the same thing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do there is no other way to get the raw data, and read them manually in the script 😞
In which form are they stored ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the link in my answer post:
$8 = path to a file where raw results of this search are located (as opposed to passing the actual results into the ticket--this could be a lot of data).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I use an email alert for grabbing the full search result to send to our ticketing system. Some of my alrets send the results as a pdf. This was simple and cleaner to interface with CA's service desk application.
I think you would have to cat $8 , but I bet its format is a not very pretty since it contains raw results
$8= File where the results for this search are stored (contains raw results)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which of the available variables will give me the results of the search? Not the fact the alert fired but the OUTPUT of the search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Then it might be the way you are handling the variables. That example was Bash, so $1, $2 etc are defined as positional parameters passed to the script. This would be represented differently in Perl. My Perl skills are not that great , but if I'm not mistaken they would be something like $ARGV[1],$ARGV[2], etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
been there, done that. It doesn't include the results.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
