Hello,
Is it possible to execute the savedsearch out of the "splunk search" action of the Automatic Search Add-on For Splunk?
If yes, could you please give the code example?
Kind Regards,
Kamil
to be more precise ...
I have the following action/search that I need to trigger:
| makeresults
|rename comment AS " *********************************** Set the list of hosts *********************************************** "
| eval master1 ="ls5920",
slave11 ="ls5921",
slave12 ="ls5922",
slave13 ="ls5923",
slave14 ="ls5924",
master2 ="ls5925",
slave21 ="ls5926",
slave22 ="ls5927",
slave23 ="ls5928",
slave24 ="ls5929"
| table [|makeresults | eval search ="master1 slave11 slave12 slave13 slave14 master2 slave21 slave22 slave23 slave24" | table search ]
| transpose
| rename "row 1" AS host_to_trigger
| table host_to_trigger
|rename comment AS " *********************************** Start rtedump triggering ********************************************* "
| eval triggertime = strftime(now(),"%H:%M")
| table host_to_trigger triggertime
| map maxsearches=20 search="dbxquery query=\"call SYS.MANAGEMENT_CONSOLE_PROC('runtimedump dump -f /usr/sap/BWP/HDB02/$host_to_trigger$/trace/DB_BWP/iAlerting_rtedump_ANOMALY_$triggertime$.trc','$host_to_trigger$:30240',?)\" connection=\"HANA_MLBSO_BWP\" "
|rename comment AS " *********************************** End rtedump triggering ************************************************ "
I defined it as the savedsearch but I am not able to find a way to execute it via "splunk search" action. also when I just paste the text of it into the "splunk search" filed alert action, it has no effect.
Could you please advice?
Kind Regards,
Kamil