Using Linux,where are Splunk arguments ($0 to $8) located?

[Isaias_Garcia]

I need to pass a variable to run a shellscript..Where do the below Splunk arguments located or i what directory or conf file they can be modified?I'm using Linux. Please advise.

0 = Script name
• 1 = Number of events returned
• 2 = Search terms
• 3 = Fully qualified query string
• 4 = Name of saved search
• 5 = Trigger reason (i.e. "The number of events was greater than 1")
• 6 = Browser URL to view the saved search
• 7 = This option has been deprecated and is no longer used
• 8 = File where the results for this search are stored (contains raw results)

[grijhwani]

They are the positional parameters as passed to the script. You will refer to them within the script as $0..$8. What you do with them within the script is up to you.

It sounds like you are a shell scripting novice, in which case you would do better to go do some basic research on shell scripting.

A quick search for "simple shell scripting" "linux" returns a flood of results, but you could do worse than start with

• http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html
• http://www.tech-faq.com/unix-shell-scripting-tutorials.html

[Ayn]

Not sure what you mean by where they're "located"? They're passed on as arguments to shell scripts you run as alert actions. It's not configurable, this is the arguments you always will get.