All Apps and Add-ons

How to get alert result in python scripts?

pipipipi
Path Finder

Hi Splunker.

It is easy question, but I don't understand.
so, could you help me?

I want to get alert result in python scripts.

I read document and I understand I should use $result. < field name > $

so, I made this search.

index=test
|rex field email"(<?name>.+)@"
|sendalert param.username=$result.name$

my python script is like this.I want to use alert result as arguments in python.

username= helper.get_param(username)

my splunk search returns Alert action param.username=$result.name$ not found.

I know I have to set up param name but I do not understand how to set.
(I can not find document to set up param name)

Is it correct way to get alert result in python?

If it is correct could you tell me where should I see to set param name?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

From Splunk documentation:
| sendalert [param.=<"value">]

param.
Syntax: param.=<"value">
Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message.

So value should be some number or string or text not a result token.

If you want to get alert result in python script then you can read results_file from stdin as below:

import sys
import csv
import json
import gzip

if __name__ == "__main__":
    try:
       settings = json.loads(sys.stdin.read())
       config = settings['configuration']
       results_file=settings['results_file']
       with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile:
           reader = csv.DictReader(rfile, lineterminator="\n")
           for row in reader:
               print({k: v for k, v in row.items() if not k.startswith("__mv_")})
    except Exception as e:
       print >> sys.stderr, "ERROR Unexpected error: %s" % e
       sys.exit(1)

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

From Splunk documentation:
| sendalert [param.=<"value">]

param.
Syntax: param.=<"value">
Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message.

So value should be some number or string or text not a result token.

If you want to get alert result in python script then you can read results_file from stdin as below:

import sys
import csv
import json
import gzip

if __name__ == "__main__":
    try:
       settings = json.loads(sys.stdin.read())
       config = settings['configuration']
       results_file=settings['results_file']
       with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile:
           reader = csv.DictReader(rfile, lineterminator="\n")
           for row in reader:
               print({k: v for k, v in row.items() if not k.startswith("__mv_")})
    except Exception as e:
       print >> sys.stderr, "ERROR Unexpected error: %s" % e
       sys.exit(1)
0 Karma

pipipipi
Path Finder

Thank you for hepling me.

I also found another way.( in this time, I use Add-on builder.)

events = helper.get_events()
for event in events:
     helper.log_info("event={}".format(event))
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...