Reporting

Splunk Alerting : How to pass arguments/filename to your script?

koshyk
Super Champion

Hi
I have savedSearch which should alert every 1 min. The searchname is "myApp_Alert_1m" and the file produced is "myApp_Alert_1m.csv". My Script is kept in $SPLUNK_HOME/bin/scripts/myAlert.py
So my SavedSearch outputs this file

 .. | outputcsv myApp_Alert_1m

How can I pass this filename as a parameter into "myAlert.py"?

( I tried putting into Enable Script where it shows "File name of shell script to run" with option, but not getting any output. )

Tags (2)
0 Karma
1 Solution

koshyk
Super Champion

Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.

Within the script it would be:

CSV_FILE_IN                =    sys.argv[4] + '.csv'
COUNT_ALERTS               =    sys.argv[1]

View solution in original post

0 Karma

koshyk
Super Champion

Found a way.
As per Documentation there are 8 arguments and "SPLUNK_ARG_4" is the "Name of report".
So the trick is to make outputcsv filename exactly same name as the Report/SavedSearch (and append by .csv etc..)
Then we can code within the script.

Within the script it would be:

CSV_FILE_IN                =    sys.argv[4] + '.csv'
COUNT_ALERTS               =    sys.argv[1]

View solution in original post

0 Karma

patelmc
Explorer

How can we use this variable SPLUNK_ARG_4  inside bash shell?

 

Is it possible to pass this variable as $i with the script?

 

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!