Alerting

Activate heavy forwarder upon alert

tonyArad
Engager

Hi,

How can I activate my heavy forwarder upon alert?
My goal is to send out data from Splunk to an external server when event occur.

Thanks!
Tony

0 Karma
1 Solution

fbl_itcs
Path Finder

Hi,

you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).

View solution in original post

fbl_itcs
Path Finder

Hi,

you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).

fbl_itcs
Path Finder

Not really. It really depends what kind of systems you are using. If it is a heavy forwarder on a Linux system it is nothing more than

"ssh splunk@computername "/opt/splunk/bin/splunk start""

Ofc. you need a passwordless login (e.g. using a key) for this to work.

0 Karma

tonyArad
Engager

Thanks!
Do you have an example of such script by chance?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...