Getting Data In

Scripted Alert Question

ubko
Explorer

Is there a way to pass the result of a savedsearch to a script? For example, if the search returns:

suser duser shost dhost me you mine yours you me yours mine

I’d like the script to the “shost” column and perform certain function based on the content of shost.

These are the arguments Splunk passes to the script. But I’m not sure they contain the results.

* $0 = script name.
* $1 = number of events returned.
* $2 = search terms.
* $3 = fully qualified query string.
* $4 = name of saved splunk.
* $5 = trigger reason (i.e. "The number of events was greater than 1").
* $6 = Browser URL to view the saved search.
* $7 = This option has been deprecated and is no longer used
* $8 = file where the results for this search are stored (contains raw results). 
Tags (1)
1 Solution

Lowell
Super Champion

No the arguments do not contain the results.

I wanted this too when I first start using splunk, but think about it this way: The results from your search could contain thousands of events, which is way too much info to pass around on the command line. So it's necessary for the results to be saved to a file first. Then splunk passes your script the name of that file as $8.


Here is something you could get started with:

my_custom_script.py:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "ssh", row["shost"], "-l", row["suser"], .... ]
    call(my_command)

View solution in original post

Lowell
Super Champion

No the arguments do not contain the results.

I wanted this too when I first start using splunk, but think about it this way: The results from your search could contain thousands of events, which is way too much info to pass around on the command line. So it's necessary for the results to be saved to a file first. Then splunk passes your script the name of that file as $8.


Here is something you could get started with:

my_custom_script.py:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "ssh", row["shost"], "-l", row["suser"], .... ]
    call(my_command)

ubko
Explorer

Since my result set is only a few lines, I was looking for a direct solution. Thank you for your suggestion and I think it'll definitely solve my immediate problem.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...