Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a way to get the "fielded" result into an alert script (and not the _raw)?

$
0
0
I have a few issues with them Basically, I want to POST to a ForeScout Web Service. My first go was for the Webhook option. It worked great, but It turned out that I cannot parameterize the URL with App-Config Items. Next, I wrote a few python scripts to do the same. However, the Python script gets the **_raw** results, while the webhook got JSON. • So I had to change the parsing code at my receiving end. • Also, while the Webhook encodes whatever format into JSON, in the _raw case I may end up parsing any format, which is quite a challenge. Is there an alert alternative that will use the best of both worlds? E.g. can I reuse the WebHook code that turns “result” into its Webhook JSON? Rama

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>