We usually get hundreds of logs and we want to execute scripts based on those logs. The key takeaway here is when Splunk scans a log file based on a message like "THIS JOB XXYYZZ" IS DOWN on server ABC" I want to execute a script passing XXYYZZ ABC as arguments.
| eval _raw="THIS JOB XXYYZZ" IS DOWN on server ABC"
| rex "JOB\s+(?<job>\S+)\s+IS\s+(?<state>\S+)\s+on\s+server\s+(?<server>\S+)"
| rename COMMENT AS "Everything above is generating sample event data; everything below is your solution"
| map search="| makeresults | YourScriptHere $job$ $server$"