Alerting

Alert Script is not running?

shreyasj
New Member

I created an alert, it is working fine. When I echo into a "echo_output.sh" file, it works fine. When I'm trying to echo the same content on the console, nothing happens. When I manually execute the file ( instead of, from the splunk) it runs as expected.

Here is the link for another question, this question also has the same issue as my question.
http://answers.splunk.com/answers/92958/alert-script-not-running-splunk.html

I hope to get some help soon.

0 Karma

Yasaswy
Contributor

Hi, Splunk will launch scripts from within it's runtime env. Does your scripts run if you run them from splunk cmd line?

    cd  to splunk_home (wherever splunk is installed)
    cd bin
    ./splunk cmd path_to_your_script/echo_output.sh
0 Karma

shreyasj
New Member

Yes, I just checked. I get the expected output when I use "./splunk cmd path_to_your_script/echo_output.sh"

0 Karma

Yasaswy
Contributor

Ok. I might have misunderstood your question. Are to trying to send off an alert to STDOUT from within splunk (using splunk scheduler)?

0 Karma

shreyasj
New Member

I want to disable the input from the console when an alert is generated.

For disabling the output, I need to "cd to the directory" where input.conf file is present and change the "disable=false" to true. I want to do this using the script which runs when I get an alert. I need my script to work on the console.

0 Karma

Yasaswy
Contributor

If your use case is to disable an input (x) on a triggered alert (y)... are you using generic cmds to make this change (sed,awk etc ) or splunk CLI?
You are essentially trying to change a config that is already active within the session. Typically making such a change via CLI (eg: splunk edit monitor) would prompt for user and password. Additionally you need to have a way to reload the config after your change. Were you planning on use a REST call for this?

0 Karma

starcher
SplunkTrust
SplunkTrust

Do you have the hashbang at the top of your script?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...