topic Re: How to execute custom script on Universal Fowarder when Event Trigger Alert raised in Getting Data In

How to execute custom script on Universal Fowarder when Event Trigger Alert raised

amit20190 — Fri, 26 Apr 2019 11:55:21 GMT

How to execute custom script on Universal Fowarder when Event Trigger Alert raised?
I am monitoring my linux audit logs, upon receiving event from the remote client (UF), I want to trigger an event alert which will execute a custom script on the remote client.
Reviewed the following but I'm not sure whether this will execute the script on the UF or on the SH which detects the event.

http://dev.splunk.com/view/dev-guide/SP-CAAAE68

Newbie

Re: How to execute custom script on Universal Fowarder when Event Trigger Alert raised

richgalloway — Fri, 26 Apr 2019 13:04:17 GMT

Alert action scripts run on the search head. Did you see this text in the link you cited?

"Keep in mind, however, that running a
script when an alert is triggered has
been deprecated in Splunk Enterprise
6.3, and therefore is not recommended for use."

Re: How to execute custom script on Universal Fowarder when Event Trigger Alert raised

amit20190 — Fri, 26 Apr 2019 13:15:25 GMT

So there isn't a way to use alert action to trigger execution of script on the Universal Forwarder?

Re: How to execute custom script on Universal Fowarder when Event Trigger Alert raised

richgalloway — Tue, 30 Apr 2019 13:52:36 GMT

I'm not aware of a way.