Alerting

Why does my alert script fail on windows?

jameshgibson
Path Finder

I have spent most of the afternoon trying to work out why the script doesn't seem to work. From the logs I found in %SPLUNK_HOME%\var\log\splunk\ the commmand will never work as long as my search command contains quotes, braces, >, < or & anywhere. e.g

C:\WINDOWS\system32\cmd.exe /c " "pathtosplunk\Splunk\bin\scripts\myscript.py" "49" "index="my_index" ("some" OR "other") | rex field=blah "(?<breakage>.*)" commands" "name_of saved search" "Saved Search [nameofsavedsearch] number of events(99)" "http://path toresults" "" "path\\to\\csv" "

Is there any solution?

Tags (2)
0 Karma

jameshgibson
Path Finder

The only way I have managed to get this working is by re-writing %SPLUNK_HOME%\etc\apps\search\bin\runshellscript.py

Clearly this is not a good solution and will break after any update.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...