passing host argument on splunk alert script

[raindrop18]

I have setup a search string and I I am trying to setup a script to restart the service when that error occur.

Ex - index="WEB" AND (Fatal OR severe)

when the search return result I want to run the script.

EX - ssh host service tomcat restart

The problem, I have multiple servers.

Ex-

 hostA

 hostB

 hostC

I want the script restart tomcat only on the server has issue like (hostB)reported on splunk alert not the rest of them.how I can pass my arguments on Splunk setup?

[martin_mueller · Accepted solution]

Make sure the host is contained in a search result field, that you have one row per host that needs to be restarted, and that the alert triggers whenever there is one or more results. Then, your alert script can grab the eighth field containing a path to the raw search results and pluck the host(s) from there.

As an alternative, the Red Alert app can pass fields from the search result to a command without having to write that yourself: http://apps.splunk.com/app/1730/
I'm not quite sure if that's production ready yet though.