Hi,
I'm new to splunk sdk so, forgive me if my question is obvious.
I'm trying to create a python script that runs a search job every minutes and give an alert if the number of events is 0.
I'm starting with the connection:
import splunklib.client as client
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
//Create a Service instance and log in
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
myquery = "*"
mysearchname = "hello"
//Check if this already exist
//mysavedsearch = service.saved_searches.create(mysearchname, myquery)
mysavedsearch = service.saved_searches["hello"]
kwargs = {"description": "This is a test search",
"is_scheduled": True,
"cron_schedule": "*/5 * * * * ",}
mysavedsearch.update(**kwargs).refresh()
print "Description: ", mysavedsearch["description"]
print "Is scheduled: ", mysavedsearch["is_scheduled"]
print "Cron schedule: ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
Ok but how do I set the parameters of the alert?
Could someone confirm if this is correct?
Thank you in advance
In the end, this is my code and work
import splunklib.client as client
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
# Create a Service instance and log in
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0
# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)
# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
"is_scheduled": True,
"cron_schedule": "*/1 * * * * ",
"alert.track":1,
"alert_comparator":"greater than",
"alert_type":"number of events",
"alert_threshold":0,
"alert.severity":5,
}
mysavedsearch.update(**kwargs).refresh()
print "Description: ", mysavedsearch["description"]
print "Is scheduled: ", mysavedsearch["is_scheduled"]
print "Cron schedule: ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track ", mysavedsearch["alert.track"]
How are you calling this script? Is it through scripted input? I have similar requirement. Please help.
In the end, this is my code and work
import splunklib.client as client
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
# Create a Service instance and log in
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0
# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)
# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
"is_scheduled": True,
"cron_schedule": "*/1 * * * * ",
"alert.track":1,
"alert_comparator":"greater than",
"alert_type":"number of events",
"alert_threshold":0,
"alert.severity":5,
}
mysavedsearch.update(**kwargs).refresh()
print "Description: ", mysavedsearch["description"]
print "Is scheduled: ", mysavedsearch["is_scheduled"]
print "Cron schedule: ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track ", mysavedsearch["alert.track"]