Alerting

Splunk Alert Script on Windows

gdavid
Path Finder

I am trying to find info on how to write a custom alert script in python on windows.

Initially i thought i would write a custom email script to modify some fields and subject lines etc to create tickets via email.
Based on this script, i could later create a ticket directly with my ticketing platform.

I can't seem to find any info on the scripts and modules available to splunk internally (ex: email). I see the SDKs for various languages but this seems to be from outside splunk. What if i want to leverage a script inside splunk and just use the same modules? i know i could rip apart the current sendemail.py, it just seems like this might be documented already somewhere.

Also there is so no clear indication for me on how to get the results of a search alert into my script.
There is an article here on how to do this, but it seems not to be for windows.
http://www.seanelavelle.com/2012/04/11/scripting-splunk-alerts-with-python/

thanks

gd

0 Karma

MartinMcNutt
Communicator

I am currently trying to do the same but with powershell. I want to execute a script to update a users attribute if value/Alert is triggered.

I found this document which I have been using to start working on it.

ConfiguringScriptedAlerts

gdavid
Path Finder

right i saw that page, but it still leaves me with a ton of questions. so in order to use python, they have this block:

to use Python to interpret the script file:
'---- myscript.py -----
'#!/path/to/python
'.....
'.....

does this mean that i need to install my own version of python? or is there a way to point it to the version installed with splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...