Refine your search:

Hi~there:

I am using python script got from here

ent123
#!/usr/bin/python
# Based on a script from http://answers.splunk.com/quesrions/3019/scripted-alert-question
import csv, gzip, sys
from subprocess import call
# Enter script location here. This will be called once per event returned by the Splunk
# search, with field1=value1 field2=value2 appended. Ignore fields starting with _
# (Ensure your scheduled search has a | fields -_* | fields x y at the end to ensure
# you get the fields you want going to your script)
scriptlocation = "/opt/splunk/etc/apps/demo/bin/demo.sh"

# The rest of this should not have to be configured
def openany(p):
    if p.endswith(".gz"):
        return gzip.open(p)
    else:
        return open(p)

event_count = int(sys.argv[1])  # number of events returned.
results_file = sys.argv[8]      # file with search results

for row in csv.DictReader(openany(results_file)):
    mycommand= "echo" + str(event_count) + row["_raw"] + >> "output.txt"

I found if event_count equals 10, but there were no 10 _raw data in output.txt, but if i use row["host"], the output lines will equal to event_count. like follows

10 rawdata...
10 rawdate...
10 rawdata...
-----------no 10 count----------
3 hostname
3 hostname
3 hostname
----------just 3 count----------

what's the probably problem with this, thanks in advance.

asked 16 Feb '12, 02:56

hjwang's gravatar image

hjwang
3121227
accept rate: 17%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×125
×24

Asked: 16 Feb '12, 02:56

Seen: 1,065 times

Last updated: 16 Feb '12, 02:56

Copyright © 2005-2012 Splunk Inc. All rights reserved.