Splunk search results

[ashvini_jain]

Hi
I recently started using splunk in my company. Being new to it, I don't know much at the back end of the splunk. I want to know how can we get search results to feed in the python script via alert action -> run script. 
Pointing towards useful  documentation also would be helpful. 

[livehybrid]

Hi @ashvini_jain 

There is some useful documentation here https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/ModAlertsBasicExample which might help with what you're looking for. Custom alerts use stdin to take in the results and can then be parsed and acted upon.

I hope this helps.

[p_gurav]

Hi Ashvini,

Here is the Splunk document which you can refer to, they also give some examples which will help to understand better.

https://docs.splunk.com/Documentation/Splunk/8.0.4/AdvancedDev/CustomAlertConvertScripted