Splunk Dev

please help !!! can splunk alert with the sound by use python script .i have a scripts but it's not play anythaing.

Watchariya
New Member

I want splunk alert the sound when find the event in alerts condition . I write script in python like this below

Python Script name : s.py

import winsound
soundfile = "c:/shine.wav"
winsound.PlaySound(soundfile, winsound.SND_FILENAME|winsound.SND_ASYNC)

when i compile this script with python GUI It can play the sound, after that I copy s.py to "C:Program Files/Splunk/bin/scripts/s.py" and in the alert condition page i set run script checkbox is enable and type s.py in the File name of shell script to run but when it alert i can't hear anything . It's only show in triggered alert and send an e-mail .It's not alert with sound. maybe wrong miss config but i don't know the wrong . what should i do to success in open the sound. Please help.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Umm, yeah. Normally, in the enterprise, Splunk is installed on a Server somewhere. So even if python plays the sound you won't hear it. If you installed it on your Desktop, it might work. Try running the python by itself and see if you hear anything (make sure your computer is not muted and the volume is up). If it is on a server not on your computer, good luck and let us know how that turns out.

alacercogitatus
SplunkTrust
SplunkTrust

Try writing an actual shell script (s.bat) that calls the python script, and use "s.bat" in the alert config.

C:\$PATH_TO_PYTHON\python C:\$SPLUNK_HOME\bin\scripts\s.py

Watchariya
New Member

I install Splunk on my desktop set it as splunk server and i test python script on my desktop too . it's can work when i test with python GUI but keep it with splunk it doesn't work . May be i think i have a miss config but i don't know what wrong. i copy my python script to "C:Program Files/Splunk/bin/scripts/s.py" . is it right? and in the setup alert page i check in script checkbox is enable and type s.py in the File name of shell script to run. is it right? Or you mean i should have 2 computer 1 for splunk server and 1 for test alert . i don't understand

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...