splunk dispatch per_results_alert tmp_0.csv file

[aaronkorn]

Hello,

In the tmp_0.csv file which contains details about the alert that fired, is there any consistency or default order of the columns? I would imagine it would write in the same columnar output as designed in the search but it seems to vary. The reason I am curious is because we are working on a script which takes the $searchPath, $ARGV[7] passed via the alert to find the values of the search and pass them through an snmp trap. If the columns wont be consistent then this might now work properly. Any help is appreciated. Thanks!

[gfuente · Accepted solution]

Hello

I found that it uses alphabetical order regardless of any sorting of fields, or the use of the fields commands in the query.

What we do is use eval to format the output fields in a way, that we consistently know whats on the csv file. Using this:

your search ... | eval 1=host | eval 2=5 | eval 3 = description | table 1,2,3

So we are sure that we are receiving this information in the csv file:
host, severity, alert description

And using this format on every alert we create, we can be sure that the script will work as expected

Regards

[aaronkorn]

AWESOME! Thanks so much.. We've been driving ourselves crazy trying to figure this out.