Here is the end result of the script that pretty much shows all the information you can grab about an alert and the corresponding events:
import json, sys, csv, gzip
if __name__ == "__main__":
if len(sys.argv) > 1 and sys.argv[1] == "--execute":
data = json.loads(sys.stdin.read())
f = open("/tmp/splunktest.txt", "w")
f.write("Here's the info we get from splunk:\n")
f.write(json.dumps((data), indent=4, sort_keys=False))
f.write("\n\nResults Data:\n")
results_file = data["results_file"]
fz = gzip.open(results_file)
results_content = csv.DictReader(fz)
for idx, row in enumerate(results_content):
f.write("Information for result #" + str(idx) + "\n")
for key, value in row.iteritems():
f.write("Key: " + str(key) + "\tValue: " + str(value) + "\n")
f.write("\n")
fz.close()
f.close()
... View more