Developing for Splunk Enterprise

How do you pass saved search parameters to a Python script?



I am trying to pass arguments from a savedsearch result to a python script, and it does not work. Code below.


action.log_message = 1 = $name$
action.log_message.param.condition = $result.condition$ = $$
action.log_message.param.source = $result.source$
alert.digest_mode = 0
alert.suppress = 0
alert.track = 1
counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -5m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=main host=test_host source=test_source status=* earliest=-2m latest=now | eval condition=if(status!="OK","CRITICAL","OK") | stats last(condition) as condition by host,source


is_custom = 1
label = test
description = test
icon_path = appIcon.png
alert.execute.cmd =
payload_format = json
disabled = 0 = 
param.condition = = 
param.source =

import json
import sys
import os
import datetime

timestamp = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")

name = config['name']
condition = config['condition']
host = config['host']
source = config['source']

f = open('temp.txt', 'w')
sys.stdout = f
sys.stderr = f
print(host, source, name, condition, timestamp)

And I get no output. If hard code some values in the script directly, then the file will be written every time the script is triggered.

Expected output

('test_host', 'test_source', 'test_search', 'condition' , 'timestamp')

Thank you in advance.


Labels (2)
0 Karma

Super Champion

As you might be aware , there will be 9 fields Splunk arguments you can get for alerting purposes

For debugging, you could print all these 9 fields out into an output and see if it is useful. There is a quite old Splunk to Tivoli script, you can see if useful. The SPLUNK_ARG_8 will give you the file in which the results for the search are stored, which you can stream out using your python script.

Also are you using Splunk's python to trigger your python script?

0 Karma


were you able to resolve this? I have similar requirement, need some help.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!