Objective: Send the search result url to a central location whenever an alert is triggered.
Current Sol: Trigger alert action script whenever no of events>0
Current Shell Script :
read sessionKey
echo "'$SPLUNK_ARG_0' '$4' '$6' '$sessionKey'" >> \
"/opt/splunk/output.txt"
I know Splunk has given "Convert a script alert action to a custom alert action" option.
But its not that clear and I don't want to modify each search query to add the sendresults option.
Link: http://docs.splunk.com/Documentation/Splunk/7.0.2/AdvancedDev/CustomAlertConvertScripted
kindly advise.
