Does anyone have an example of a custom alert action script that uses a bash script?

[gregbo]

All the ones I ever see is Python. I need one that uses a bash script.

[Azeemering]

my_custom_action.sh

 #!/bin/bash
 ResultsList=$(cat $8|gzip -d|tail -n +2)
 echo $ResultsList > output.txt

Taking each command as it comes:

ResultsList will contain the results of your Splunk search

cat $8 when splunk executes your script the $8 parameter will be the path of the search results on your server. Cat will output the contents of the file and pass it to:

gzip -d - this will decompress the results to make them readable, and then:

tail -n +2 - will ignore the top line which is the header, and start reading from line 2!

echo $ResultsList will write the results of the above into output.txt for you to review.