https://community.splunk.com/t5/Getting-Data-In/How-To-Restart-A-Windows-based-Service-From-A-Triggered-Alert/m-p/387160#M69440 <P>Hi,</P> <P>I have created a Splunk alert that will be triggered when a Windows-based service is down (ie. Print Spooler). For example, it will check a list of servers real-time and display the server/host if the Print Spooler service is down. My question is how do I automatically restart that Windows &gt; Print Spooler service using the "Run a script" action from the alert? Do I need to create a batch script and put in the "$SPLUNK_HOME/bin/scripts" folder? Our Splunk search heads/indexer are running on Linux.</P> <P>Can someone help with an example on what the script should look like? Do I just create a simple batch script with the following line... </P> <P>sc.exe start "Print Spooler"</P> <P>Also, do I need to pass the $result.host$ to the script so that it knows which server/host to run the script?</P> <P>Thank you for your advice.</P> Fri, 16 Nov 2018 16:14:01 GMT bennykhoo 2018-11-16T16:14:01Z https://community.splunk.com/t5/Getting-Data-In/How-To-Restart-A-Windows-based-Service-From-A-Triggered-Alert/m-p/387160#M69440 <P>Hi,</P> <P>I have created a Splunk alert that will be triggered when a Windows-based service is down (ie. Print Spooler). For example, it will check a list of servers real-time and display the server/host if the Print Spooler service is down. My question is how do I automatically restart that Windows &gt; Print Spooler service using the "Run a script" action from the alert? Do I need to create a batch script and put in the "$SPLUNK_HOME/bin/scripts" folder? Our Splunk search heads/indexer are running on Linux.</P> <P>Can someone help with an example on what the script should look like? Do I just create a simple batch script with the following line... </P> <P>sc.exe start "Print Spooler"</P> <P>Also, do I need to pass the $result.host$ to the script so that it knows which server/host to run the script?</P> <P>Thank you for your advice.</P> Fri, 16 Nov 2018 16:14:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-To-Restart-A-Windows-based-Service-From-A-Triggered-Alert/m-p/387160#M69440 bennykhoo 2018-11-16T16:14:01Z https://community.splunk.com/t5/Getting-Data-In/How-To-Restart-A-Windows-based-Service-From-A-Triggered-Alert/m-p/387161#M69441 <P>I'd like to know the same thing. I've been trying to do something very similar for about 6 months and read every document splunk has and nothing seems to work. </P> Thu, 04 Apr 2019 17:36:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-To-Restart-A-Windows-based-Service-From-A-Triggered-Alert/m-p/387161#M69441 sals1648 2019-04-04T17:36:05Z