Alerting

Execute a script when a file is uploaded

guidovicino
New Member

Hi,

we need to trigger a script that makes an SQL insert and this script needs to be triggered when a file is loaded inside Spunk, ie:

  1. An external job create a log file: /upload_dir/foo_20130320_20.dat
  2. Splunk read and store the /upload_dir/foo_20130320_20.dat
  3. Splunk delete the /upload_dir/foo_20130320_20.dat after the loading
  4. An alert is triggered and a script executed.

Thanks and best regards,
Guido.

0 Karma

guidovicino
New Member

@martin_mueller

Thank you for the answer but I do not understand what you mean with "LicenseUsage". I've worked with other SIEM products but I'm a Splunk newbie.

I thought to exploit the real-time search in the following manner. If I insert a bait with a string appended to the file like this:

SIEM\_SOME\_UNIQUEID\_END\_OF\_LOG\_filename\_date\_time.dat

and define an alert that runs the script when I find a record with this string and triggers the execution of a script by using the following features:

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitorfilesanddirectories

What do you think?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Detecting the deletion may be hard to do, however you can try fiddling with Metrics and LicenseUsage from _internal for sources that match your upload dir. Those may or may not approximate what you need.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...