Hello,
We usually get hundreds of logs and we want to execute scripts based on those logs. The key takeaway here is when Splunk scans a log file based on a message like "THIS JOB XXYYZZ" IS DOWN on server ABC" I want to execute a script passing XXYYZZ ABC as arguments.
Note: JOB name and server name changes.
Like this:
| makeresults
| eval _raw="THIS JOB XXYYZZ" IS DOWN on server ABC"
| rex "JOB\s+(?<job>\S+)\s+IS\s+(?<state>\S+)\s+on\s+server\s+(?<server>\S+)"
| rename COMMENT AS "Everything above is generating sample event data; everything below is your solution"
| map search="| makeresults | YourScriptHere $job$ $server$"
Hi thsvinayb4u,
you are looking for custom alert action; find the docs here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsIntro
All you need to know about passing tokens to your alert script can be found here http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModAlertsLog
Hope this helps to get you started ...
cheers, MuS