
runshellscript
The runshellscript
command is an internal, unsupported, experimental command. See
About internal commands.
Description
For Splunk Enterprise deployments, executes scripted alerts. This command is not supported as a search command.
Syntax
runshellscript <script-filename> <result-count> <search-terms> <search-string> <savedsearch-name> <description> <results-url> <deprecated-arg> <results_file>
Usage
The script file needs to be located in either $SPLUNK_HOME/etc/system/bin/scripts
OR $SPLUNK_HOME/etc/apps/<app-name>/bin/scripts
. The following table describes the arguments passed to the script. These arguments are not validated.
Argument | Description |
---|---|
$0 | The filename of the script. |
$1 | The result count, or number of events returned. |
$2 | The search terms. |
$3 | The fully qualified query string. |
$4 | The name of the saved search in Splunk. |
$5 | The description or trigger reason. For example, "The number of events was greater than 1." |
$6 | The link to saved search results. |
$7 | DEPRECATED - empty string argument. |
$8 | The path to the results file, results.csv . The results file contains raw results.
|
See also
PREVIOUS prjob |
NEXT sendalert |
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012, 8.1.2101
Feedback submitted, thanks!