Alerting

Scripted Alert Parameters in a Search Query Using runshellscript

greich
Communicator
  • | head 1 | addinfo | runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated $search_id$

works until the last parameter. The output is:

'/opt/splunk/bin/scripts/echo.sh' 'DummyEventNumber' 'DummySearchTerms' 'DummyFullQuery' 'DummySearchName' 'DummyReason' 'DummyURL' 'Deprecated' '/opt/splunk/var/run/splunk/dispatch/$search_id$/results.csv.gz' ''

My real script processes the results, so I need to retrieve the search_id (or addinfo | info_sid) to construct the path. Any idea how to materialise the value instead of passing the variable name?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You can try a map, since you have a single event result.

| head 1 | addinfo | map search=" runshellscript echo.sh DummyEventNumber DummySearchTerms DummyFullQuery DummySearchName DummyReason DummyURL Deprecated /opt/splunk/var/run/splunk/dispatch/$info_sid$/results.csv.gz"

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The info_sid is correct. If there are events, the file should be there. If no events, the file won't exist, which may cause that error. Did you confirm the file exists manually? Also, this is unsupported by Splunk. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Runshellscript

0 Karma

greich
Communicator

using this with $search_id$ leads to:
Error in 'map': Did not find value for required attribute 'search_id'.
and using $info_sid$, it seems to work, but doesn't retrieve the correct search id and the script fails with: ERROR|2014-01-03 15:01:27,063 - exception =[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/1388761284.347923/results.csv.gz'
if I execute the first part and copy the search id, then paste it manually in the runshellscript parameters, it works fully, but not with the map.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...