Occasionally for one reason or another you may need to call a script when an alert triggers within Splunk. This is pretty easy with Python as long as you keep a couple things in mind. First, is that one the script is called via the Splunk alert, all the important data is passed from via environmental variables.

Reading these is fairly straight forward using the os module:

import os

#Read the environment variables that Splunk has passed to us
scriptName = os.environ['SPLUNK_ARG_0']
numberEventsReturned = os.environ['SPLUNK_ARG_1']
searchTerms = os.environ['SPLUNK_ARG_2']
queryString = os.environ['SPLUNK_ARG_3']
searchName = os.environ['SPLUNK_ARG_4']
triggerReason = os.environ['SPLUNK_ARG_5']
browserUrl = os.environ['SPLUNK_ARG_6']
rawEventsFile = os.environ['SPLUNK_ARG_8']

You can find more information on what the environmental variable contain here : http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurescriptedalerts

The other thing to keep in mind is that Splunk does not actually pass the actual data that generated the alert. That data is stored in an file (a gzipped csv (at least on unix)) and the location of the file is passed to us. So if we need to action the actual alert data within our script we will need to read the events out of the file. Luckily again, this is pretty straight forward with the csv and gzip modules in the standard library:

import gzip
import csv

logFile = open('/tmp/splunk_alert_events', 'a')

#We got the file name from the envioenment vars
eventFile = csv.reader(gzip.open(rawEventsFile, 'rb'))
for line in eventFile:
logFile.write(line)

logFile.close()

Putting it all together, we get this:

import os
import csv
import gzip

if __name__ == "__main__":

#Read the environment variables that Splunk has passed to us
scriptName = os.environ['SPLUNK_ARG_0']
numberEventsReturned = os.environ['SPLUNK_ARG_1']
searchTerms = os.environ['SPLUNK_ARG_2']
queryString = os.environ['SPLUNK_ARG_3']
searchName = os.environ['SPLUNK_ARG_4']
triggerReason = os.environ['SPLUNK_ARG_5']
browserUrl = os.environ['SPLUNK_ARG_6']
rawEventsFile = os.environ['SPLUNK_ARG_8']

logFile = open('/tmp/splunk_alert_events', 'a')

#We got the file name from the envioenment vars
eventFile = csv.reader(gzip.open(rawEventsFile, 'rb'))
for line in eventFile:
logFile.write(line)

logFile.close()

Saving this script in $SPLUNK_HOME/bin/scripts and set the alert to call the script (without the path; all scripts are assumed to run from $SPLUNK_HOME/bin/scripts) and you now have a script that will right the events that caused the alert to a file in /tmp.

I’ve been hearing people talk about how useful list comprehensions in Python are for a while now, but it never really seemed to click until recently. When it did, I find myself using them all the time. Basically list comprehnsion is a way to create a list from a list. It’s fast and makes a lot of sense once you see it in action.

One thing I find myself doing a lot is checking if any member of a list of strings is within another string. We should easily write this as a loop:

>>> myList = ['a.html', 'b.html', 'c.html']
>>> myString = "www.someserver.com/dir1/b.html"
>>> for item in myList:
    if item in myString:
        print "Found %s in %s" % (item, myString)

Found b.html in www.someserver.com/dir1/b.html
>>>

Not too bad, but we can write it as a list comprehension even more succinctly:

>>> myList = ['a.html', 'b.html', 'c.html']
>>> myString = "www.someserver.com/dir1/b.html"
>>> myHits = [x for x in myList if x in myString]
>>> myHits
['b.html']
>>>

We can even use the whole list comprehension as a test:

>>> myString2 = 'www.someserver.com/dir2/d.html'

>>> if [x for x in myList if x in myString]:
    print "Got a hit on %s" % myString

Got a hit on www.someserver.com/dir1/b.html

>>> if [x for x in myList if x in myString2]:
    print "Got a hit on %s" % myString2
else:
    print "No hits on %s" % myString2

No hits on www.someserver.com/dir2/d.html

I know this seems like a somewhat trivial example, but once you start replacing loops with list comprehensions you can see the uses all over the place. Here are some more good examples of using list comprehensions:

http://docs.python.org/tutorial/datastructures.html#list-comprehensions
http://docs.python.org/howto/functional.html#generator-expressions-and-list-comprehensions
http://www.siafoo.net/article/52 (Section 2 deals with list comprehensions)