Pass variable to a scripted alert

[Valky]

Hi,

I would like to pass variable to run a perl script.
I did it with fixed value and it runs well, but now i want to get Ip and user name from a search to run my scritp. I also did a alert with conditions to run the script and it works to. But i don't see where to send arguments ? Do i have to parse the field to extract the right value with regex into my script ? The documention here is not useful cause you can't see where and how to pass value. http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Configuringscriptedalerts

[brettcarroll]

Do i have to parse the field to extract the right value with regex into my script?
YES

A file location containing the search results will be in $ARGV7.
From my testing this file is a gzipped CSV file.
To access the results, you will need to gunzip the file, open the file in $ARGV[7] and parse the results:

Example perl script:

$filename = $ARGV[7]; 

gunzip $filename; # gunzip the results file
$filename =~ s/.gz$//; # remove ".gz" from $filename
open('RESULTS', '<', $filename) or die($!);
while (<RESULTS>){
my $result = $_;
# do something with $result;
}
close('RESULTS');

[ljbur1]

Valky, you said in your question "I did it with a fixed value and it runs well". I've tried passing a fixed/literal value to an alert script and it doesn't fire. Can you explain how you did that? What was the syntax you used?
Thanks!

[Mathieu_Dessus]

Hello,

you have to take the argument number 8 which contains the path to the file containing all events that matched the alert criteria. You then have to parse the CSV data in this file to find what you're interested in.

See the latest answer here:
http://splunk-base.splunk.com/answers/749/how-do-i-pass-event-arguments-to-scripts-run-in-response-t...

Update: See my 2nd anwser below with a script example.

[Mathieu_Dessus]

So, if you want to use one or a few specific fields, add a table command with the needed parameters, at the end of your search:

my_search_cmd | table src, host, rhost

The result file will contain:
host,rhost,src,"mv_host","mv_rhost","__mv_src"
myhostname1,"1.2.3.4",myhostname2,,,

Then use the following script in the alert:
http://mdessus.free.fr/Divers/splunk_alert.pl

And take care of any " that my be passed by the alert to the script unescaped.

[gantonio]

hi Mathieu,

I wanr to see the content of the URL provided above, but upon opening the link it only provides me a blank Webpage.
Is it possible to paste the content of teh script here?

thanks,
glen

[Valky]

Thanks you for your answer but I'm still in a stalemate.
Actualy I don't know where to declare this argument (into my script ?).
And if so the correct syntax in perl.
Please give me a step by step procedure or a example on how to do it