In script action alert type for my data, what should be the format of entering field names in my python script file for sumologic to recognize those field names?


1 comment

  • Official comment
    Matt Sullivan

    Looks as if this has gone a while without an answer. Apologies for the delay.

    I'm not 100% sure I'm following the question but will take a stab. Sumo Logic doesn't need to understand what you write in Python, it's the other way around. When a script alert is executed by the collector it will pass a first parameter that is a JSON file path. In Python you can use sys.argv[1] to get that file name and start reading its contents. Code might look something like the following:

    import sys, json

    with open(sys.argv[1]) as json_file:
    data = json.load(json_file)
    results = data['queryResults']
    for r in results:
    # now varies based on your query, e.g. r['field_name_from_sumo_query']
    Comment actions Permalink

Please sign in to leave a comment.