topic Re: Problem with scripted alert in Getting Data In

Problem with scripted alert

tinpelayee — Fri, 13 Mar 2020 17:44:43 GMT

Hello plp,

I am making an alert, that export a csv , the problem here is when this .csv is exported, only have rw permissions and i want to have rw-r. I make a script that convert this file with the permissions i want, but is dont working. I have read all the doc of configurating scripted alerts, but i cant resolve this problem.

Can anyone helpme?

Re: Problem with scripted alert

manjunathmeti — Wed, 30 Sep 2020 04:34:00 GMT

Scripted alert action is officially deprecated. Use custom alert action. Check this page to convert scripted action to custom alert action.

https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

Simple steps to create an app for custom alert action:

Step 1: Create new app script_custom_alert_action and create app.conf and alert_actions.conf like below. Copy configuration files to script_custom_alert_action/default.

app.conf

 [ui]
 is_visible = 0
 label = Scripted Custom Alert Action

 [launcher]
 description = Scripted Custom Alert Action

 [install]
 state = enabled
 is_configured = 1

alert_actions.conf

 [scriptcustomalert]
 is_custom = 1
 label = Scripted Custom Alert Action

Step 2: Rename your script. Script name must be same as stanza name in alert_actions.conf. Example scriptcustomalert.py or scriptcustomalert.sh. Put it in script_custom_alert_action/bin.

Step 3: Create default.meta and copy it in script_custom_alert_action/metadata. This enables all users to configure custom alert action for their alerts in any app.

[]
access = read : [ * ], write : [ admin ]
export = system

Step 4: Deploy app and restart splunk. New action "Scripted Custom Alert Action" will appear in alert action list on UI in alert configurations and you can select it and verify.

Re: Problem with scripted alert

tinpelayee — Fri, 13 Mar 2020 18:22:07 GMT

thanks , i have read this a lot of times, but i cant resolve the problem.

can you help me with this configuration?

Re: Problem with scripted alert

tinpelayee — Fri, 13 Mar 2020 18:25:04 GMT

thanks , i have read this a lot of times, but i cant resolve the problem.

can you help me with this configuration?

Re: Problem with scripted alert

manjunathmeti — Fri, 13 Mar 2020 18:38:44 GMT

Updated my answer.

Re: Problem with scripted alert

tinpelayee — Fri, 13 Mar 2020 20:02:06 GMT

i can created but my script doesnt change the permissions of the csv 😞

Re: Problem with scripted alert

manjunathmeti — Sat, 14 Mar 2020 09:35:59 GMT

I tested with below python script and it's working. Check with this script.

scriptcustomalert.py

Search query I used:

index=_internal earliest=-5m | stats count by sourcetype | outputcsv test.csv

Re: Problem with scripted alert

tinpelayee — Mon, 16 Mar 2020 12:17:46 GMT

Thanks Bro, it works!!!!