That did the trick! So much better. Thank you! I was hoping there was a way I could do it through configuration, but if through search is the only way, that works too. Very much appreciated. ... View more

Thanks! I decided to just use the Splunk Add-On Builder to make my own app to do it. We will see how that goes. ... View more

FYI... Kinda what I thought. These apps can't read the new audit logs. No option for that with the current version. ... View more

I knew it collected metrics, but not the logs. I will give it a try - Thank you! Very much appreciated. ... View more

I see this question allot all over the place and honestly, I think it's comparing apples and oranges. While there is some overlap in functionality, I think both cater to their own specific things. ... View more

It seems really strange to me that Splunk has yet to offer a method to "pull". Recently, Dynatrace made the Dynatrace SaaS logs available through their API. I want to pull these into Splunk. I agree with Rich that it looks like the only way to do this is through the API and writing something on your own to execute the pull. ... View more

I too had this question some time ago and found no really good answer but figured it out. I used the Splunk Add-On Builder to create a new app for Splunk. Then with a very small script made posteifmsg available as an alert option from within Splunk. Very easy to do and effective. Below is my code if it helps you or anyone else trying to do this. # encoding = utf-8 import os import sys import time import datetime import subprocess def process_event(helper, *args, **kwargs): """ # OMNIbus Splunk Integration # Version 1.0 # Author Larry Roberts # ENV SIT # Dependency: posteifmsg # Location: /lcl/sit/apps/splunk/default/etc/apps/TA-OMNIbus/bin/posteifmsg # # IMPORTANT # Do not remove the anchor macro:start and macro:end lines. # These lines are used to generate sample code. If they are # removed, the sample code will not be updated when configurations # are updated. [sample_code_macro:start] # The following example gets the alert action parameters and prints them to the log gfs_impact = helper.get_param("gfs_impact") helper.log_info("gfs_impact={}".format(gfs_impact)) gfs_urgency = helper.get_param("gfs_urgency") helper.log_info("gfs_urgency={}".format(gfs_urgency)) easyvista_category_id = helper.get_param("easyvista_category_id") helper.log_info("easyvista_category_id={}".format(easyvista_category_id)) event_summary = helper.get_param("event_summary") helper.log_info("event_summary={}".format(event_summary)) # The following example adds two sample events ("hello", "world") # and writes them to Splunk # NOTE: Call helper.writeevents() only once after all events # have been added helper.addevent("hello", sourcetype="sample_sourcetype") helper.addevent("world", sourcetype="sample_sourcetype") helper.writeevents(index="summary", host="localhost", source="localhost") # The following example gets the events that trigger the alert events = helper.get_events() for event in events: helper.log_info("event={}".format(event)) # helper.settings is a dict that includes environment configuration # Example usage: helper.settings["server_uri"] helper.log_info("server_uri={}".format(helper.settings["server_uri"])) [sample_code_macro:end] """ helper.log_info("omnibus_event: Alert action OMNIbus started.") # Remove characters that will break the posteifmsg syntax summary_fix=helper.get_param("event_summary").replace('"', '').replace("'", '') category_fix=helper.get_param("easyvista_category_id").replace('"', '').replace("'", '') # Map values to posteifmsg syntax requirements value1="-f /lcl/sit/apps/splunk/default/etc/apps/TA-OMNIbus/bin/config.ini" value2="-m "+"'"+summary_fix+"'" value3="GFS_Impact="+helper.get_param("gfs_impact") value4="GFS_Urgency="+helper.get_param("gfs_urgency") value5="GFS_Category="+"'"+category_fix+"'" value6="Node=Splunk" value7="Generic" value8="Splunk" # Fire the posteifmsg command os.system("/lcl/sit/apps/splunk/default/etc/apps/TA-OMNIbus/bin/posteifmsg %s %s %s %s %s %s %s %s" % (value1,value2,value3,value4,value5,value6,value7,value8)) # Log the fire event to Splunk helper.addevent("omnibus_alert:"+summary_fix+" GFS_Impact:"+helper.get_param("gfs_impact")+" GFS_Urgency:"+helper.get_param("gfs_urgency")+" Category:"+category_fix, sourcetype="omnibus_alert") helper.writeevents(index="main", host="localhost", source="localhost") return 0 ... View more

I would say yes. That is the same thing I found. The only way I could make it so that a value from a search is passed is to have it declared within the search itself like you are doing above. If there is another way, I never found it. ... View more

Thanks!!!! ... View more

So doing something like this in the code.... helper.log_info("Alert action started.") You would not be able to find in a Splunk search? ... View more

Ah! I see. So as long as I account for helper.get_param("abc") it should pull it in then? As long as it was supplied in the search that set off the alert that is. Does that sound correct? Just trying to make sure I account for how the syntax should be in the script. So like this.... value2="-m "+"'"helper.get_param("abc")"'" Correct? And BIG THANK YOU for the assistance on this! ... View more

Thanks for all the help! ... View more

Thank you. Yes, I had seen that in the commented area. For some reason though I can not seem to figure out how to pull that value in to here: value2="-m "+"'"+"SPLUNK EVENT VALUE SHOULD BE HERE"+"'" I thought it would be something like.... value2="-m "+"'"+$event+"'" But that gives me an error. Any ideas? Thanks! ... View more

Well, I made progress in the Splunk Add-On Builder. I am now able to execute my binary and pass the parameters that I have setup. The only thing I can't seem to figure out now is how to pass the event that set off the alert in the first place. See towards the bottom where it says "SPLUNK EVENT VALUE SHOULD BE HERE". I want to capture there what triggered the alert but I am unsure of how to call that information there. Thank you for the assistance!!!!! # encoding = utf-8 import os import sys import time import datetime import subprocess def process_event(helper, *args, **kwargs): """ # IMPORTANT # Do not remove the anchor macro:start and macro:end lines. # These lines are used to generate sample code. If they are # removed, the sample code will not be updated when configurations # are updated. [sample_code_macro:start] # The following example gets the alert action parameters and prints them to the log gfs_impact = helper.get_param("gfs_impact") helper.log_info("gfs_impact={}".format(gfs_impact)) gfs_urgency = helper.get_param("gfs_urgency") helper.log_info("gfs_urgency={}".format(gfs_urgency)) easyvista_category_id = helper.get_param("easyvista_category_id") helper.log_info("easyvista_category_id={}".format(easyvista_category_id)) # The following example adds two sample events ("hello", "world") # and writes them to Splunk # NOTE: Call helper.writeevents() only once after all events # have been added helper.addevent("hello", sourcetype="sample_sourcetype") helper.addevent("world", sourcetype="sample_sourcetype") helper.writeevents(index="summary", host="localhost", source="localhost") # The following example gets the events that trigger the alert events = helper.get_events() for event in events: helper.log_info("event={}".format(event)) # helper.settings is a dict that includes environment configuration # Example usage: helper.settings["server_uri"] helper.log_info("server_uri={}".format(helper.settings["server_uri"])) [sample_code_macro:end] """ helper.log_info("Alert action OMNIbus started.") # TODO: Implement your alert action logic here value1="-f /lcl/sit/apps/splunk/splunk6.4.0/etc/apps/TA-OMNIbus/bin/config.ini" value2="-m "+"'"+"SPLUNK EVENT VALUE SHOULD BE HERE"+"'" value3="GFS_Impact="+helper.get_param("gfs_impact") value4="GFS_Urgency="+helper.get_param("gfs_urgency") value5="ISOC_Instructions="+"'"+helper.get_param("easyvista_category_id")+"'" value6="Generic" value7="Generic" os.system("/lcl/sit/apps/splunk/splunk6.4.0/etc/apps/TA-OMNIbus/bin/posteifmsg %s %s %s %s %s %s %s" % (value1,value2,value3,value4,value5,value6,value7)) return 0 ... View more

Ok, so there is no way to execute a binary directly them from the Add-On Builder in Splunk? Just want to make sure I am understanding correctly. I would need to create a Python script that is called by the Add-On Builder and then that script would execute the binary? Thank you!!!! ... View more

I have installed the Add-On Builder and started with that. Do you know where I could find sample code on doing such things as executing a binary like nco_postmsg and passing information to it? Thanks! ... View more

Agreed. Netcool is a HUGE effort. We have used it for many years now and are still just scratching the surface. Then again, we also only have a single administrator which is me 🙂 ... View more

Thank you all for the great information! I do not see this as a replacement either but wanted some other opinions on this as well. Splunk is a strong tool set that we are using and plan to expand on but not in terms of event management. Thank you!!! ... View more