Alerting

splunk dispatch per_results_alert tmp_0.csv file

aaronkorn
Splunk Employee
Splunk Employee

Hello,

In the tmp_0.csv file which contains details about the alert that fired, is there any consistency or default order of the columns? I would imagine it would write in the same columnar output as designed in the search but it seems to vary. The reason I am curious is because we are working on a script which takes the $searchPath, $ARGV[7] passed via the alert to find the values of the search and pass them through an snmp trap. If the columns wont be consistent then this might now work properly. Any help is appreciated. Thanks!

Tags (3)
0 Karma
1 Solution

gfuente
Motivator

Hello

I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query.

What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this:

your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3

So we are sure that we are receiving this information in the csv file:
host, severity, alert description

And using this format on every alert we create, we can be sure that the script will work as expected

Regards

View solution in original post

gfuente
Motivator

Hello

I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query.

What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this:

your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3

So we are sure that we are receiving this information in the csv file:
host, severity, alert description

And using this format on every alert we create, we can be sure that the script will work as expected

Regards

aaronkorn
Splunk Employee
Splunk Employee

AWESOME! Thanks so much.. We've been driving ourselves crazy trying to figure this out.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...