How to get alert result in python scripts?

[pipipipi]

Hi Splunker.

It is easy question, but I don't understand.
so, could you help me?

I want to get alert result in python scripts.

I read document and I understand I should use $result. < field name > $

so, I made this search.

index=test
|rex field email"(<?name>.+)@"
|sendalert param.username=$result.name$

my python script is like this.I want to use alert result as arguments in python.

username= helper.get_param(username)

my splunk search returns Alert action param.username=$result.name$ not found.

I know I have to set up param name but I do not understand how to set.
(I can not find document to set up param name)

Is it correct way to get alert result in python?

If it is correct could you tell me where should I see to set param name?

[manjunathmeti · Accepted solution]

From Splunk documentation:
| sendalert [param.=<"value">]

param.
Syntax: param.=<"value">
Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message.

So value should be some number or string or text not a result token.

If you want to get alert result in python script then you can read results_file from stdin as below:

import sys
import csv
import json
import gzip

if __name__ == "__main__":
    try:
       settings = json.loads(sys.stdin.read())
       config = settings['configuration']
       results_file=settings['results_file']
       with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile:
           reader = csv.DictReader(rfile, lineterminator="\n")
           for row in reader:
               print({k: v for k, v in row.items() if not k.startswith("__mv_")})
    except Exception as e:
       print >> sys.stderr, "ERROR Unexpected error: %s" % e
       sys.exit(1)

[pipipipi]

Thank you for hepling me.

I also found another way.( in this time, I use Add-on builder.)

events = helper.get_events()
for event in events:
     helper.log_info("event={}".format(event))