Splunk Dev

How do you pass saved search parameters to a Python script?

andrei1bc
Communicator

Hi,

I am trying to pass arguments from a savedsearch result to a python script, and it does not work. Code below.

savedsearches.conf

[test_search]
action.log_message = 1
action.log_message.param.name = $name$
action.log_message.param.condition = $result.condition$
action.log_message.param.host = $result.host$
action.log_message.param.source = $result.source$
alert.digest_mode = 0
alert.suppress = 0
alert.track = 1
counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -5m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=main host=test_host source=test_source status=* earliest=-2m latest=now | eval condition=if(status!="OK","CRITICAL","OK") | stats last(condition) as condition by host,source

alert_actions.conf

[log_message]
is_custom = 1
label = test
description = test
icon_path = appIcon.png
alert.execute.cmd = test.py
payload_format = json
disabled = 0
param.name = 
param.condition = 
param.host = 
param.source = 

test.py

#!/bin/python
import json
import sys
import os
import datetime

timestamp = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")

name = config['name']
condition = config['condition']
host = config['host']
source = config['source']

f = open('temp.txt', 'w')
sys.stdout = f
sys.stderr = f
print(host, source, name, condition, timestamp)
f.close()

And I get no output. If hard code some values in the script directly, then the file will be written every time the script is triggered.

Expected output

('test_host', 'test_source', 'test_search', 'condition' , 'timestamp')

Thank you in advance.

Regards,

Labels (2)
0 Karma

koshyk
Super Champion

As you might be aware , there will be 9 fields Splunk arguments you can get for alerting purposes
https://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts

For debugging, you could print all these 9 fields out into an output and see if it is useful. There is a quite old Splunk to Tivoli script, you can see if useful. The SPLUNK_ARG_8 will give you the file in which the results for the search are stored, which you can stream out using your python script.

Also are you using Splunk's python to trigger your python script?

0 Karma

vasanthi77
Explorer

were you able to resolve this? I have similar requirement, need some help.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...