Hi~there:
I am using python script got from here
ent123
#!/usr/bin/python
# Based on a script from http://answers.splunk.com/quesrions/3019/scripted-alert-question
import csv, gzip, sys
from subprocess import call
# Enter script location here. This will be called once per event returned by the Splunk
# search, with field1=value1 field2=value2 appended. Ignore fields starting with _
# (Ensure your scheduled search has a | fields -_* | fields x y at the end to ensure
# you get the fields you want going to your script)
scriptlocation = "/opt/splunk/etc/apps/demo/bin/demo.sh"
# The rest of this should not have to be configured
def openany(p):
if p.endswith(".gz"):
return gzip.open(p)
else:
return open(p)
event_count = int(sys.argv[1]) # number of events returned.
results_file = sys.argv[8] # file with search results
for row in csv.DictReader(openany(results_file)):
mycommand= "echo" + str(event_count) + row["_raw"] + >> "output.txt"
I found if event_count equals 10, but there were no 10 _raw data in output.txt, but if i use row["host"], the output lines will equal to event_count. like follows
10 rawdata...
10 rawdate...
10 rawdata...
-----------no 10 count----------
3 hostname
3 hostname
3 hostname
----------just 3 count----------
what's the probably problem with this, thanks in advance.
asked
16 Feb '12, 02:56
hjwang
312●1●2●27
accept rate:
17%