Triggering script from alert

[bharatkalra]

Hi,

I have an alert set up in splunk which runs every 30 minutes, the alert is running fine as I am receiving the email properly. I also have enabled a test.sh script on the splunk server and want it to be executed when the alert is run. Permission of the script is 755 which shouldn't be any issue. Script is located at /home/splunk/bin/scripts as specified in the help manual. Script is running fine when run manually, but somehow it is not getting executed from splunk. Even there is no entry in splunkd.log file for the execution. Script is nothing but an echo and creation of a .log file at the same location, which is not being created as of now.

Could somebody help me in this situation, would really appreciate. Let me know if I am doing something wrong or if there is anything missing from my part.

Thanks in Advance!!

[bharatkalra]

Hello Kristian,

Thanks for responding to my question.

I also wondered to the point you made. But actually, /opt has a soft link splunk which is pointing to /home/splunk so it doesn't make any difference of the location as both are same location.

Best Regards,
Bharat Kalra

[kristian_kolb]

Did you put it in /home/splunk/bin/scripts? That is not likely to work.

You might be mixing it up with $SPLUNK_HOME, which is the base directory of the Splunk installation (and not the home-dir of the splunk user).

On *nix systems that usually is /opt/splunk and on win*-systems it is c:\program files\splunk.

So put your script in /opt/splunk/bin/scripts (or it's windows equivalent).

Hope this helps,

K

[kristian_kolb]

have you looked at the splunkd.log for error messages?

[bharatkalra]

Hello Kristian,

Thanks for responding to my question.

I also wondered to the point you made. But actually, /opt has a soft link splunk which is pointing to /home/splunk so it doesn't make any difference of the location as both are same location.

Best Regards,
Bharat Kalra