Reporting

Splunk Alerting : How to pass arguments/filename to your script?

koshyk
Super Champion

Hi
I have savedSearch which should alert every 1 min. The searchname is "myApp_Alert_1m" and the file produced is "myApp_Alert_1m.csv". My Script is kept in $SPLUNK_HOME/bin/scripts/myAlert.py
So my SavedSearch outputs this file

 .. | outputcsv myApp_Alert_1m

How can I pass this filename as a parameter into "myAlert.py"?

( I tried putting into Enable Script where it shows "File name of shell script to run" with option, but not getting any output. )

Tags (2)
0 Karma
1 Solution

koshyk
Super Champion

Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.

Within the script it would be:

CSV_FILE_IN                =    sys.argv[4] + '.csv'
COUNT_ALERTS               =    sys.argv[1]

View solution in original post

0 Karma

koshyk
Super Champion

Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.

Within the script it would be:

CSV_FILE_IN                =    sys.argv[4] + '.csv'
COUNT_ALERTS               =    sys.argv[1]
0 Karma

patelmc
Explorer

How can we use this variable SPLUNK_ARG_4  inside bash shell?

 

Is it possible to pass this variable as $i with the script?

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...