Splunk Search

Does anyone have an example of a custom alert action script that uses a bash script?

gregbo
Communicator

All the ones I ever see is Python. I need one that uses a bash script.

0 Karma

Azeemering
Builder

my_custom_action.sh

 #!/bin/bash
 ResultsList=$(cat $8|gzip -d|tail -n +2)
 echo $ResultsList > output.txt

Taking each command as it comes:

ResultsList will contain the results of your Splunk search

cat $8 when splunk executes your script the $8 parameter will be the path of the search results on your server. Cat will output the contents of the file and pass it to:

gzip -d - this will decompress the results to make them readable, and then:

tail -n +2 - will ignore the top line which is the header, and start reading from line 2!

echo $ResultsList will write the results of the above into output.txt for you to review.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...