Alerting

How to integrate Python script with Splunk (input, output)

manuelag
Engager

I have a Splunk alert which returns some JSON results as well as the usual Splunk fields and sends them by email to several recipients.

The results are not so readable by humans, so I have created a Python script to beautify them so they keep only the strictly necessary information and present it to the users in a neat way.

I know that I can pass a Python script in an alert configuration, however I'm not sure how the Python script can get the input values (the JSONs from the alert) nor what format to use for the output so it replaces the old JSONs in the emails.

My script calculates a priority score for each JSON in the email and I was wondering whether there was a way to include the highest score value in the subject of the email (I read about the variables, but couldn't find anything useful)...

Please advise.

0 Karma
1 Solution

Yasaswy
Contributor

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8']

eg:
import os
json_results = os.environ['SPLUNK_ARG_8']

Check out full details Here

However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition...

View solution in original post

Yasaswy
Contributor

Hi, The positional arguments for the alert are available as env var. If the JSON you are working on is in the search results you should be able to access it from the dispatch file... os.environ['SPLUNK_ARG_8']

eg:
import os
json_results = os.environ['SPLUNK_ARG_8']

Check out full details Here

However, if you are planning to email out the formatted results, I think it will have to be done from your script itself. From the alert perspective the email and the script are triggered per the same condition...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...