Scripted Alert Question

[ubko]

Is there a way to pass the result of a savedsearch to a script? For example, if the search returns:

suser duser shost dhost me you mine yours you me yours mine

I’d like the script to the “shost” column and perform certain function based on the content of shost.

These are the arguments Splunk passes to the script. But I’m not sure they contain the results.

* $0 = script name.
* $1 = number of events returned.
* $2 = search terms.
* $3 = fully qualified query string.
* $4 = name of saved splunk.
* $5 = trigger reason (i.e. "The number of events was greater than 1").
* $6 = Browser URL to view the saved search.
* $7 = This option has been deprecated and is no longer used
* $8 = file where the results for this search are stored (contains raw results). 

[Lowell · Accepted solution]

No the arguments do not contain the results.

I wanted this too when I first start using splunk, but think about it this way: The results from your search could contain thousands of events, which is way too much info to pass around on the command line. So it's necessary for the results to be saved to a file first. Then splunk passes your script the name of that file as $8.

---

Here is something you could get started with:

my_custom_script.py:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "ssh", row["shost"], "-l", row["suser"], .... ]
    call(my_command)

[ubko]

Since my result set is only a few lines, I was looking for a direct solution. Thank you for your suggestion and I think it'll definitely solve my immediate problem.