Alerting

How to create a python script that generates an alert if the number of events returned from a search is 0?

Federica_92
Communicator

Hi,

I'm new to splunk sdk so, forgive me if my question is obvious.
I'm trying to create a python script that runs a search job every minutes and give an alert if the number of events is 0.

I'm starting with the connection:

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

//Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

myquery = "*"
mysearchname = "hello"

//Check if this already exist
//mysavedsearch = service.saved_searches.create(mysearchname, myquery)
mysavedsearch = service.saved_searches["hello"]

kwargs = {"description": "This is a test search",
        "is_scheduled": True,
        "cron_schedule": "*/5 * * * *  ",}

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]

Ok but how do I set the parameters of the alert?
Could someone confirm if this is correct?

Thank you in advance

0 Karma
1 Solution

Federica_92
Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]

View solution in original post

k_harini
Communicator

How are you calling this script? Is it through scripted input? I have similar requirement. Please help.

0 Karma

Federica_92
Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...