Hi @splunkettes, I’m a Community Moderator in the Splunk Community. This question was posted 1 year ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

Hi @splunkettes  - I’m a Community Moderator in the Splunk Community.  This question was posted 4 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

I realize this is a dated post but is closely aligned with the issue I am having with my shell script custom alert action.. Please elaborate on how you read in the stdin arguments to the shell script. I copied the sample script in the docs. The alert triggers the script and will print the $0 but the rest of the variables are null. Do I need to list the SPLUNK_ARG_x variables out in the alert_actions.conf? ... View more

Hi @splunkettes  Please guide how you created the custom search command similar to outputlookup command.    ... View more

I checked limits.conf and cannot find any settings to control this. So either it's undocumented or a different setting.   This might be best as a support case, or if it doesn't exist on ideas.splunk.com, but I'd log a support case first in case it does exist... ... View more

Via the outputlookup command ... View more

Do you know why audittrail shows "N/A" for user when a Splunk user creates a lookup file? For example, I created a lookup file testingLookupCreationAudit.csv using the outputlookup command and the logged event for it showed, Audit:[timestamp=08-17-2020 15:02:32.078, user=n/a, action=add,path="/data/1/splunk/etc/apps/search/lookups/testingLookupCreationAudit.csv", isdir=0, size=117, gid=1001, uid=1001, modtime="Mon Aug 17 14:54:10 2020", mode="rw-------", hash=][n/a] Why didn't Splunk log my user name in this event? ... View more

This is pretty close to what I'm trying to do as well. Curious if you got it to work? ... View more

I modified the files how you suggested. Doing so changes the default permissions applied when the user runs the outputlookup command. So now if a user creates a lookup file with the command it creates a lookup owned by nobody and only admins can modify it. I think the lack of ownership is an issue with the command itself rather than the metadata settings because when you go to the lookup files page and select to create a new lookup, that new file is created as a private object under the user's account. I may need to look into limiting who can run the outputlookup command so that we can reduce the number of ad hoc lookups created by nobody. We have a scripted process to reassign these lookups based on the last person who ran an outputlookup to create/updated the file, but I was trying to stop the creation of lookup files without owners at its source.  If anyone knows how the outputlookup command is programmed in Splunk, I'd love to see it. It should function like the lookup-table-files.xml (Create new lookup form) in ...\Splunk\etc\apps\search\default\data\ui\manager\data_lookup_table_files.xml but it clearly doesn't. 😞 ... View more

Did you get an answer for this? I am also looking to change the default behavior of how lookups are created. A few years back I believe the default behavior was to create the lookup as a private object under the user's app directory... which was way better for object management.  ... View more