Archive

Shell script execution after a search and outputcsv

Engager

Hi,
I'm trying to run the following query:
index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | movealert

movealert at the end of the query is a batch file hosted on my server.
If I run the first part of the command, it creates the updatedalert.csv file as expected.
If I run a search only with "| movealert" alone, the script executes and moves the files to my lookup directory.
But when I try to run both command combined, none of them executes as if one was blocking the other.

Any idea if (and how) I can this to work?

Tags (1)
0 Karma
1 Solution

Communicator

Hi..

try below query..

| movealert [search index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | return NULL]

View solution in original post

Communicator

Hi..

try below query..

| movealert [search index=alerts Status="Open" AlertId="30822ac3b4a6138de30c5726e2e05931"|table _time, AlertId, host, user, AlertMsg, "Close", |head 1
|outputcsv updatedalert | return NULL]

View solution in original post

Engager

Works perfectly! Thanks a lot anjambha!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!