Alerting

How to integrate Python script with Splunk (input, output)

manuelag
Engager

I have a Splunk alert which returns some JSON results as well as the usual Splunk fields and sends them by email to several recipients.

The results are not so readable by humans, so I have created a Python script to beautify them so they keep only the strictly necessary information and present it to the users in a neat way.

I know that I can pass a Python script in an alert configuration, however I'm not sure how the Python script can get the input values (the JSONs from the alert) nor what format to use for the output so it replaces the old JSONs in the emails.

My script calculates a priority score for each JSON in the email and I was wondering whether there was a way to include the highest score value in the subject of the email (I read about the variables, but couldn't find anything useful)...

Please advise.

0 Karma
1 Solution

Yasaswy
Contributor

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8']

eg:
import os
json_results = os.environ['SPLUNK_ARG_8']

Check out full details Here

However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition...

View solution in original post

Yasaswy
Contributor

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8']

eg:
import os
json_results = os.environ['SPLUNK_ARG_8']

Check out full details Here

However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition...

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...