Suggestion on sending search output to external server based on alert condition

[phagunbaya]

I have created an alert which triggers a script based on a condition defined in alert. After the script triggers, it should pull the data based on the search and sends the data to an external server by calling it's POST API.

I'm having trouble getting data based on the search alert because the Splunk search API needs to be authenticated to get the data.

Is there any different approach to deal with this? My goal is to create an alert programmatically and upon trigger I need to send the data to external server.

[woodcock · Accepted solution]

There should be a file that is created (gzipped, I believe) with your search results that you should be able to access directly that contains the results right there. It is in the 8th argument ($ARGV[7]) and there for the taking, with no need to authenticate.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Configuringscriptedalerts#Access_arguments_t...