Alerting

how to include search results in python custom alert script

pranay_adla
Explorer

have a custom alert action scripts which have UI. If I give a fieldname in UI that needs to get value from search result and append to sid. How can I use $results.fieldnme$ or any other solution for this.

0 Karma

jaime_ramirez
Communicator

For Custom Alert Actions tokens you could use this guide:

https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsLog#Pass_search_result_value...
https://docs.splunk.com/Documentation/Splunk/7.3.0/Alert/EmailNotificationTokens#Search_metadata_tok...

So in your case if you want to pass some field results (lets name it Results_To_Pass) and also the sid of the search, you could put it like this in the UI:

Results: $results.Results_To_Pass$
Search Job: $job.sid$

Then the python script would parse this and perform its particular function.

If you could provide more info it would be great.

Hope it helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...