How do i create a custom python script to get the result and modify them to send mail in splunk

[linu1988]

Hello Everyone,
I would like to run a script that customizes the output of a savedsearch and send emails. I am not able to get any reference from where i would start. Could any one help me get any reference or guidance for creating a script how it can be called when a savedseach is being executed? I am able to get the script customized which is provided by splunk, but with that i am able to achieve only one custom script per App.

Any kind of help will be appreciated. Thanks

[yannK · Accepted solution]

You could use a regular scheduled search with an alert condition. And specify a scripted alert, that will be called if the condition is achieved.
Then you write the script, one of the parameter is the path to the csv file containing the results, you can process them before emailing them.

see http://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts