Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Splunk Alerting : How to pass arguments/filename t...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I have savedSearch which should alert every 1 min. The searchname is "myApp_Alert_1m" and the file produced is "myApp_Alert_1m.csv". My Script is kept in $SPLUNK_HOME/bin/scripts/myAlert.py
So my SavedSearch outputs this file
.. | outputcsv myApp_Alert_1m
How can I pass this filename as a parameter into "myAlert.py"?
( I tried putting into Enable Script where it shows "File name of shell script to run" with
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.
Within the script it would be:
CSV_FILE_IN = sys.argv[4] + '.csv'
COUNT_ALERTS = sys.argv[1]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.
Within the script it would be:
CSV_FILE_IN = sys.argv[4] + '.csv'
COUNT_ALERTS = sys.argv[1]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can we use this variable SPLUNK_ARG_4 inside bash shell?
Is it possible to pass this variable as $i with the script?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
