passing arguments to shell script alert action

[kumar28]

Hello,

I have an alert which results a host name and task name whenever certain task goes down on the servers. I want to run a script(.sh) alert action in Splunk web based on this triggered alert, where that script would reset the status of that task to running. In doing so, I had to pass host name and task name as parameters to the shell script. I already have a script but have to pass parameters to it. How would I pass those particular parameters to that script? Detailed explanation would be kind enough. An example for this kind of script with parameters would be appreciated

Thanks

[harsmarvania57]

Hi @kumar28,

If you are using "Run a script" (alert action) then this feature has been deprecated since Splunk 6.3 and splunk introduced new feature Custom Alert Action but "Run a script" (alert action) is still working.

If you want to fetch parameter for "alert action" then please refer http://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Configuringscriptedalerts

Based on the documentation $SPLUNK_ARG_8 gives you filename with full path in which query result will be stored, it will be compressed (.gz) CSV file. Once you have this file you can zcat command in linux to read content from compressed CSV file and you can implement your logic to read every row and required column value from that file.

If you are trying to implement "Custom Alert Action" then you can use read payload in your script to fetch payload value and from that payload you will able to find results_file parameter which gives you filename with full path in which query result will be stored, it will be compressed (.gz) CSV file and then you can perform same logic which I explained above in "alert script".

I hope this helps.

Thanks,
Harshil