Developing for Splunk Enterprise
Highlighted

How do you create a Splunk alert action that sends all results to a Python script?

Path Finder

Im trying to make a simple Python script that uses all the search results at once.

e.g
the search is

index="someindex"

the result is

amount | host

1 | some-host
3 | some-host-2
6 | some-host

I want to be able to get all the results in my Python script.

In my alert_actions.conf, I can use e.g. param.param1 = I can use a token: $result.amount$.

But, this only gives the value for the first row. I want to handle all results at once.

When looking at other alert actions, the Send email action is able to generate a whole table which means the data can be passed.

Can anyone give the most basic example of how to pass ALL the search results to a Python script?

0 Karma
Highlighted

Re: How do you create a Splunk alert action that sends all results to a Python script?

SplunkTrust
SplunkTrust

@sboogaar,

When you call a script as part of an alert action, you could use the 8th argument, which is the file name and location in which the results for the search are stored. It contains raw results in gzip file format. So, in your Python script, you could use that file and read the full search result.

See here for e.g. : https://docs.splunk.com/Documentation/Splunk/7.2.0/Alert/Configuringscriptedalerts

and more in https://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/CustomAlertConvertScripted

View solution in original post

Highlighted

Re: How do you create a Splunk alert action that sends all results to a Python script?

Path Finder

How does one use those result.csv.gz files in python?
I assume other people did it before but I can not find a link to an example or am I overlooking the obvious.
Our Splunk env is running python 2.7.13.
Edit: it is working now with: https://docs.python.org/2.7/library/gzip.html#module-gzip

0 Karma
Highlighted

Re: How do you create a Splunk alert action that sends all results to a Python script?

SplunkTrust
SplunkTrust

I had done something similar like this to open and read

def open_res_file(file_name):
    if file_name.endswith(".gz"):
        return gzip.open(file_name)
    else
        return open(file_name)

result_reader=csv.reader(open_res_file(file_name))

Once you have the content, loop through that and process the data how you want. Let me know if you need any help

0 Karma