Splunk Search

How to get argument to run a script in perl

Valky
Explorer

I did a alert to run a script and it runs with fixed variable. But now i want to pass variable (argument 😎 but I don't know how to do and the correct syntax to call argument 8 into my script

Tags (1)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

Argument #8 provides the location of a file with the results of the search. The file keeps the search results is in gzip compressed format. At this point you have two choices: 1) you can read the contents of that file or 2) pass the entire file to your script.

Let us assume that you are working in a UNIX/Linux environment and that you want to pass the contents of the results file to a third-party program. At this point you will use the shell wrapper to pass the results variable and let the third-party program deal with the data set.


#! /bin/sh

perlExec=/usr/bin/perl
perlScript=$SPLUNK_HOME/bin/scripts/createServiceNow_ticket.pl
results=$(zcat $8)
$perlExec $perlScript "$results"



On the other hand, you may be working in MS Windows and you may want to pass the entire file to another program. The alert function allows you to use a BATCH program as a wrapper and then you would pass the right content to a third-party program. If that were the case, you might use something like this:


@echo off

set SPLUNK_HOME=C:\Progra~1\Splunk
set SCRIPT="%SPLUNK_HOME%\bin\scripts\tivoliparser.ps1"
set POWERSHELL="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

%POWERSHELL% -file %SCRIPT% "%SPLUNK_ARG_8%"



Of course there are many other variations of these types of use so judge these examples as basic illustrations.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...