What we have found is that scripts for scripted alerts must live in $SPLUNK_HOME/bin/scripts, and they don't get passed the data directly. However, they are passed the data file of the data returned by the search in $8. So, you can write a launcher script which gets called by the alert, reads the file, and passes the appropriate values to the script you really want to run (such as the one in your app that creates additional input.) #!/usr/bin/python # Based on a script from http://answers.splunk.com/quesrions/3019/scripted-alert-question import csv, gzip, sys from subprocess import call # Enter script location here. This will be called once per event returned by the Splunk # search, with field1=value1 field2=value2 appended. Ignore fields starting with _ # (Ensure your scheduled search has a | fields -_* | fields x y at the end to ensure # you get the fields you want going to your script) scriptlocation = "/opt/splunk/etc/apps/demo/bin/demo.sh" # The rest of this should not have to be configured def openany(p): if p.endswith(".gz"): return gzip.open(p) else: return open(p) event_count = int(sys.argv[1]) # number of events returned. results_file = sys.argv[8] # file with search results for row in csv.DictReader(openany(results_file)): # Build a command line to call based on fields from splunk output my_command = [ scriptlocation ] for col in row: if col[0]!="_": my_command.append(col + '=' + row[col]) call(my_command) ... View more

I answered this here: http://answers.splunk.com/questions/8384/how-do-i-enable-url-links-in-output ... View more

Note that this becomes quite easy if you use the Sideview Table module instead of the SimpleResultsTable module, and it doesn't require writing a custom module or any custom code at all. Say your field was called "url", and say it was a fully formed URL, including the http:// and all that. All you would use is the following XML in your view: <module name="Table"> <module name="HTML" group="row.fields.url"> <param name="html"><![CDATA[ <a href="$row.fields.url$">$row.fields.url$</a> ]]></param> </module> </module> There are docs about this feature within Sideview Utils itself. Note that you'll need a relatively recent version of Sideview Utils (currently 2.3) from the Sideview site ( http://sideviewapps.com/apps/sideview-utils ) and not the older version available on Splunkbase. Once you get the app installed/upgraded, you can find those docs under "Module Documentation > The Table Module > Table - Embedding Examples". To paraphrase the official docs though, if the Table finds itself with any module immediately downstream that has a group attribute matching "row.fields.someField", and it finds that it actually has a field called "someField" in the results it's rendering, then instead of rendering ordinary text as the contents of those tablecells, it will process and render the given module config. In this case we've given it just a simple HTML module, and as you can see we tell it to render a link in the tablecell instead. ... View more

Thanks. That worked, but I strongly question the value of that error message. ... View more

It doesn't matter whether the field is separately indexed or not. Please note that the ad-kv fields are also not extracted at index time, and are not any more "first-class" than the keyword fields. It simply appears that way because "diff" operates line-by-line against the full raw text, and the non-keyword fields happen to be on their own lines. What you really need is a field-by-field diff, which sadly Splunk does not come with. ... View more

unfortunately, no. ... View more

Doh! Awsome. Thanks. ... View more