Alerting

Scripted Alert Parameters in a Search Query Using runshellscript

greich
Communicator
  • | head 1 | addinfo | runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated $search_id$

works until the last parameter. The output is:

'/opt/splunk/bin/scripts/echo.sh' 'DummyEventNumber' 'DummySearchTerms' 'DummyFullQuery' 'DummySearchName' 'DummyReason' 'DummyURL' 'Deprecated' '/opt/splunk/var/run/splunk/dispatch/$search_id$/results.csv.gz' ''

My real script processes the results, so I need to retrieve the search_id (or addinfo | info_sid) to construct the path. Any idea how to materialise the value instead of passing the variable name?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You can try a map, since you have a single event result.

| head 1 | addinfo | map search=" runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated /opt/splunk/var/run/splunk/dispatch/$info_sid$/results.csv.gz"

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The info_sid is correct. If there are events, the file should be there. If no events, the file won't exist, which may cause that error. Did you confirm the file exists manually? Also, this is unsupported by Splunk. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Runshellscript

0 Karma

greich
Communicator

using this with $search_id$ leads to:
Error in 'map': Did not find value for required attribute 'search_id'.
and using $info_sid$, it seems to work, but doesn't retrieve the correct search id and the script fails with: ERROR|2014-01-03 15:01:27,063 - exception =[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/1388761284.347923/results.csv.gz'
if I execute the first part and copy the search id, then paste it manually in the runshellscript parameters, it works fully, but not with the map.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...