Hi,
How can I activate my heavy forwarder upon alert?
My goal is to send out data from Splunk to an external server when event occur.
Thanks!
Tony
Hi,
you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).
Hi,
you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).
Not really. It really depends what kind of systems you are using. If it is a heavy forwarder on a Linux system it is nothing more than
"ssh splunk@computername "/opt/splunk/bin/splunk start""
Ofc. you need a passwordless login (e.g. using a key) for this to work.
Thanks!
Do you have an example of such script by chance?