Alerting

splunk dispatch per_results_alert tmp_0.csv file

aaronkorn
Splunk Employee
Splunk Employee

Hello,

In the tmp_0.csv file which contains details about the alert that fired, is there any consistency or default order of the columns? I would imagine it would write in the same columnar output as designed in the search but it seems to vary. The reason I am curious is because we are working on a script which takes the $searchPath, $ARGV[7] passed via the alert to find the values of the search and pass them through an snmp trap. If the columns wont be consistent then this might now work properly. Any help is appreciated. Thanks!

Tags (3)
0 Karma
1 Solution

gfuente
Motivator

Hello

I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query.

What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this:

your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3

So we are sure that we are receiving this information in the csv file:
host, severity, alert description

And using this format on every alert we create, we can be sure that the script will work as expected

Regards

View solution in original post

gfuente
Motivator

Hello

I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query.

What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this:

your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3

So we are sure that we are receiving this information in the csv file:
host, severity, alert description

And using this format on every alert we create, we can be sure that the script will work as expected

Regards

View solution in original post

aaronkorn
Splunk Employee
Splunk Employee

AWESOME! Thanks so much.. We've been driving ourselves crazy trying to figure this out.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!