topic Run a custom script in Splunk Enterprise

Run a custom script

syedsaadat — Fri, 20 Oct 2023 07:45:56 GMT

I came across of running a custom python script in Splunk on the triggered events by adding the run a script action but I don't know how to do it. As the alerts are visible on Splunk I want to run a script and extract those triggered alerts by running a script.

Re: Run a custom script

richgalloway — Mon, 23 Oct 2023 18:21:30 GMT

Where did you come across this feature? As I recall, Splunk removed the ability to run a script as an alert action years ago.

Re: Run a custom script

_JP — Fri, 20 Oct 2023 16:44:15 GMT

You can create a Custom Alert Action that is backed by your python script:

Using custom alert actions - Splunk Documentation

And here's the developer details on how you need to set things up:

https://dev.splunk.com/enterprise/docs/devtools/customalertactions/

Re: Run a custom script

syedsaadat — Mon, 23 Oct 2023 05:19:58 GMT

Yes I came across that thing. So is there a alternative way to run python scripts?

Re: Run a custom script

syedsaadat — Mon, 23 Oct 2023 05:59:34 GMT

I tried implementing slack app but unable to send alerts to splunk so can you guide me through how to use the app to send alerts without using webhook.

Re: Run a custom script

_JP — Mon, 23 Oct 2023 17:14:30 GMT

The old way of just running a python script as an alert action was deprecated a while back. It was a really simple, "run script and here's the search data." That way is old and busted...so it is not around anymore.

The new hotness is Custom Alert Actions. You can create one that runs your python. There's some more setup/configuration so it is registered with the system and more effort goes into packaging it up as an official configuration in Splunk (official as in you made it for your environment...).

Here is a previous discussion on this topic, too.