All the ones I ever see is Python. I need one that uses a bash script.
my_custom_action.sh
#!/bin/bash
ResultsList=$(cat $8|gzip -d|tail -n +2)
echo $ResultsList > output.txt
Taking each command as it comes:
ResultsList will contain the results of your Splunk search
cat $8 when splunk executes your script the $8 parameter will be the path of the search results on your server. Cat will output the contents of the file and pass it to:
gzip -d - this will decompress the results to make them readable, and then:
tail -n +2 - will ignore the top line which is the header, and start reading from line 2!
echo $ResultsList will write the results of the above into output.txt for you to review.