I'm wondering if someone of you did already send Splunk Events via msend to BMC Event Manager and how you can do it?
If not, can you tell me if there is a easy way to take somehow the different fields of a Splunk event and handle it with a script outside where you can send the different variables/values?
We have the tool msend where you can send events with for example
msend -q -n emh1 -r [SEVERITY] -a YOURCLASS -b "mc_host=[SPLUNKEVENTPART1];mc_host_address=[SPLUNKEVENTPART2];mc_host_class=[SPLUNKEVENTPART3];mc_object_class=[SPLUNKEVENTPART4];mc_object=[SPLUNKEVENTPART5];msg=[SPLUNKEVENTPART5]"
Those fields/value SPLUNKEVENTPARTx I should become out from Splunk.
Appreciate your help.
Create an alert script in $SPLUNK_HOME/bin/scripts/call_bmc.py or any other scripting language that you are familiar with. When you alert on a rule, have it execute the script (just call_bmc.py or whatever you call it). The 8th parameter passed to the script will be a file containing the results of the search. You can open and read this file from the script.
I would create search macros that add columns or rows to your search that could give instructions to the script. You may also want to make the script intelligent with a config file and some kind of alerting language (extra credit). If it's good, post it as an app to Splunkbase 🙂