Reporting

How do i create a custom python script to get the result and modify them to send mail in splunk

linu1988
Champion

Hello Everyone,
I would like to run a script that customizes the output of a savedsearch and send emails. I am not able to get any reference from where i would start. Could any one help me get any reference or guidance for creating a script how it can be called when a savedseach is being executed? I am able to get the script customized which is provided by splunk, but with that i am able to achieve only one custom script per App.

Any kind of help will be appreciated. Thanks

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

You could use a regular scheduled search with an alert condition. And specify a scripted alert, that will be called if the condition is achieved.
Then you write the script, one of the parameter is the path to the csv file containing the results, you can process them before emailing them.

see http://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts

View solution in original post

yannK
Splunk Employee
Splunk Employee

You could use a regular scheduled search with an alert condition. And specify a scripted alert, that will be called if the condition is achieved.
Then you write the script, one of the parameter is the path to the csv file containing the results, you can process them before emailing them.

see http://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...