Getting Data In

Scripted Alert Question

ubko
Explorer

Is there a way to pass the result of a savedsearch to a script? For example, if the search returns:

suser duser shost dhost me you mine yours you me yours mine

I’d like the script to the “shost” column and perform certain function based on the content of shost.

These are the arguments Splunk passes to the script. But I’m not sure they contain the results.

* $0 = script name.
* $1 = number of events returned.
* $2 = search terms.
* $3 = fully qualified query string.
* $4 = name of saved splunk.
* $5 = trigger reason (i.e. "The number of events was greater than 1").
* $6 = Browser URL to view the saved search.
* $7 = This option has been deprecated and is no longer used
* $8 = file where the results for this search are stored (contains raw results). 
Tags (1)
1 Solution

Lowell
Super Champion

No the arguments do not contain the results.

I wanted this too when I first start using splunk, but think about it this way: The results from your search could contain thousands of events, which is way too much info to pass around on the command line. So it's necessary for the results to be saved to a file first. Then splunk passes your script the name of that file as $8.


Here is something you could get started with:

my_custom_script.py:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "ssh", row["shost"], "-l", row["suser"], .... ]
    call(my_command)

View solution in original post

Lowell
Super Champion

No the arguments do not contain the results.

I wanted this too when I first start using splunk, but think about it this way: The results from your search could contain thousands of events, which is way too much info to pass around on the command line. So it's necessary for the results to be saved to a file first. Then splunk passes your script the name of that file as $8.


Here is something you could get started with:

my_custom_script.py:

import gzip
import csv
from subprocess import call

def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    # Build a command line to call based on fields from splunk output
    my_command = [ "ssh", row["shost"], "-l", row["suser"], .... ]
    call(my_command)

ubko
Explorer

Since my result set is only a few lines, I was looking for a direct solution. Thank you for your suggestion and I think it'll definitely solve my immediate problem.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...