How can we execute a script that uses fields from a message?

[thsvinayb4u]

Hello,

We usually get hundreds of logs and we want to execute scripts based on those logs. The key takeaway here is when Splunk scans a log file based on a message like "THIS JOB XXYYZZ" IS DOWN on server ABC" I want to execute a script passing XXYYZZ ABC as arguments.

Note: JOB name and server name changes.

[woodcock]

Like this:

| makeresults
| eval _raw="THIS JOB XXYYZZ" IS DOWN on server ABC"
| rex "JOB\s+(?<job>\S+)\s+IS\s+(?<state>\S+)\s+on\s+server\s+(?<server>\S+)"

| rename COMMENT AS "Everything above is generating sample event data; everything below is your solution"

| map search="| makeresults | YourScriptHere $job$ $server$"

[MuS]

Hi thsvinayb4u,

you are looking for custom alert action; find the docs here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsIntro

All you need to know about passing tokens to your alert script can be found here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsLog

Hope this helps to get you started ...

cheers, MuS