Getting Data In
Highlighted

How can we execute a script that uses fields from a message?

New Member

Hello,

We usually get hundreds of logs and we want to execute scripts based on those logs. The key takeaway here is when Splunk scans a log file based on a message like "THIS JOB XXYYZZ" IS DOWN on server ABC" I want to execute a script passing XXYYZZ ABC as arguments.

Note: JOB name and server name changes.

0 Karma
Highlighted

Re: How can we execute a script that uses fields from a message?

SplunkTrust
SplunkTrust

Hi thsvinayb4u,

you are looking for custom alert action; find the docs here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsIntro

All you need to know about passing tokens to your alert script can be found here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsLog

Hope this helps to get you started ...

cheers, MuS

0 Karma
Highlighted

Re: How can we execute a script that uses fields from a message?

Esteemed Legend

Like this:

| makeresults
| eval _raw="THIS JOB XXYYZZ" IS DOWN on server ABC"
| rex "JOB\s+(?<job>\S+)\s+IS\s+(?<state>\S+)\s+on\s+server\s+(?<server>\S+)"

| rename COMMENT AS "Everything above is generating sample event data; everything below is your solution"

| map search="| makeresults | YourScriptHere $job$ $server$"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.