Archive
Highlighted

Scripted Alert Parameters in a Search Query Using runshellscript

Communicator
  • | head 1 | addinfo | runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated $search_id$

works until the last parameter. The output is:

'/opt/splunk/bin/scripts/echo.sh' 'DummyEventNumber' 'DummySearchTerms' 'DummyFullQuery' 'DummySearchName' 'DummyReason' 'DummyURL' 'Deprecated' '/opt/splunk/var/run/splunk/dispatch/$search_id$/results.csv.gz' ''

My real script processes the results, so I need to retrieve the searchid (or addinfo | infosid) to construct the path. Any idea how to materialise the value instead of passing the variable name?

0 Karma

Re: Scripted Alert Parameters in a Search Query Using runshellscript

SplunkTrust
SplunkTrust

You can try a map, since you have a single event result.

| head 1 | addinfo | map search=" runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated /opt/splunk/var/run/splunk/dispatch/$info_sid$/results.csv.gz"

0 Karma
Highlighted

Re: Scripted Alert Parameters in a Search Query Using runshellscript

Communicator

using this with $searchid$ leads to:
Error in 'map': Did not find value for required attribute 'search
id'.
and using $info_sid$, it seems to work, but doesn't retrieve the correct search id and the script fails with: ERROR|2014-01-03 15:01:27,063 - exception =[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/1388761284.347923/results.csv.gz'
if I execute the first part and copy the search id, then paste it manually in the runshellscript parameters, it works fully, but not with the map.

0 Karma
Highlighted

Re: Scripted Alert Parameters in a Search Query Using runshellscript

SplunkTrust
SplunkTrust

The info_sid is correct. If there are events, the file should be there. If no events, the file won't exist, which may cause that error. Did you confirm the file exists manually? Also, this is unsupported by Splunk. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Runshellscript

0 Karma