A Script Action passes the results of a scheduled search to a script or program that runs on a machine with an installed Collector. The results are temporarily saved to the filesystem in JSON format at:
This fully-qualified path is passed as the first parameter to the script or program you configure in the Script Action. Anything printed to STDOUT will be collected and searchable.
Step 1. Set up the Script Action
- Create the script. See the example in this topic.
- In Sumo Logic select Manage Data > Collection > Collection (Manage > Collection in the classic UI).
- Find the name of the Installed Collector to which you'd like to add a Source and select Add > Add Script Action.
- Enter a name to display for the Script Action. Description is optional.
- If you'd like to specify a timeout for your script, select Specify a timeout for your command. Setting a timeout ensures that a script is killed, making sure that resources aren't fully consumed. If you choose to set a timeout, make sure to select a generous amount of time to make sure that the script has enough time to finish running.
- For Command, choose the type of command you're going to use.
- In the Script text box, type the script's path. The script itself cannot be typed in the Script text box. (When the Collector executes this script, it will pass the full path to a file containing the search results that triggered the Script Action as the first and only parameter.)
- For Working Directory, specify a directory if you need your script action to execute in a different directory than the Collector's install directory.
- Click Save.
Step 2. Set up a Scheduled Search
After the Script Action has been added to your Sumo Logic account, you can create a scheduled search. The Search name will appear in the output file, along with the query.
The first time the scheduled search executes, output files will begin to be generated.
This example shows how to set up a script and configure a Script Action.
- Create a shell script countNumberOfWarnings.sh, with the following contents:
num=`grep -oi "WARN" $1 | wc -l`
echo "The number of \"WARN\" in the scheduled search result is $num"
This script reads the output file of the scheduled search, counts the number of the appearances of keyword “WARN”, and then prints out the resulting number. For example, if the keyword “WARN” appears 10 times in the scheduled search results, the script print the following:
“The number of "WARN" in the scheduled search result is 10”.
- Set the shell script as an executable file:
chmod +x countNumberOfWarnings.sh
- Select Manage Data > Collection > Collection.
- Find the name of the installed Collector to which you'd like to add a Source and select Add > Add Script Action.
- Configure the Script Action as described previously in this topic.
- Define a search and click Save As.
- Click Schedule this search, complete the search configuration. Select Alert Type for Script Action and select the script that you created. Click Save.
The Collector creates an alerts directory in the working directory to store the results of the search, as in this example:
When the Collector gets the result of the scheduled search, it runs the script defined by the customer to process the results. The output of the script is collected by the script action, and you can run a query to get the results.
For this example, the Collector runs the following system command:
/bin/sh /Users/yluo/Development/sumo/collector/countNumberOfWarnings.sh /Users/yluo/Development/sumo/collector/alerts/000000000ABA1879-02-19-12-08-19-5.txt
is the shell script defined earlier for processing the data, and
is the output file of the scheduled search.
If you run the following query:
is the name of the script action, the output of the script is displayed.
About the search results file
The Sumo Logic file is the result of a scheduled search written in JSON format. It includes the results of the scheduled search, as well as information about the time range of the search. By default, the files are stored in the Collector installation directory. Every three hours the files are purged.
A maximum of 10,000 messages are included in the file. Each message in the search results is marked with the Collector's metadata and a time stamp. At the end of each file you'll find information about the scheduled search:
- End of scheduled search (Unix timestamp)
- Beginning time of scheduled search.
- User account.
- Name of the scheduled search (reflects the name saved with the search; can be modified)
- Query saved as the scheduled search.
- Click the URL to view the results of the search in a web page.
- Number of messages.