Getting Data In

External Lookup not passing argument contents to script

New Member

I have a external lookup that is not passing the search argument data to the script driving the lookup.

Here is my transform.conf:

external_cmd = NotificationData.bat Notification
external_type = executable
fields_list = Notification, Notes, Summary, Severity, ClassName, InstanceName, EventName, EventText

I created a wrapper script which is the executable for the lookup:

set arg1=%1
D:\InCharge\CONSOLE\smarts\bin\sm_perl.exe %arg1%

The search which drives this is passing one argument, Notification. This argument is a field from the search output:

| stats count
| eval Notification="NOTIFICATION-VoltageSensor_FaultPowerSupply210CiscoUCSChassis_I-VoltageSensorFaultPowerSupply210_CiscoUCSChassis-VOLT-BEM-[ALBISC02CR-N4R3-FAB]/2/3356137/Chassis-2/Psu-4/210V_OutOfRange"
| table Notification
| lookup NotificationData1 Notification

My script is a perl program which I have defined logging to give me various messages as the script progresses. One of my first messages is to display the Notification argument from the lookup command.

No such luck. The perl script is reporting that I am getting them NAME of the argument, Notification not the value.

What could be the problem?

Any help at this point would be appreciated.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...