topic Saving alert triggerred scripts inside apps in Alerting

Saving alert triggerred scripts inside apps

Leo — Thu, 18 Feb 2010 08:13:02 GMT

I want to configure a saved search alert to trigger a script contained inside my app. The security measures only allow me to run the script from $SPLUNK_HOME/bin/scripts, making it difficult to ship it with the app.

Is there a workaround for this?

Re: Saving alert triggerred scripts inside apps

Leo — Thu, 18 Feb 2010 08:18:13 GMT

The solution would be to put the script inside /etc/apps/[appname]/bin and put the script name in savedsearches.conf:

action.script.filename = myscript.bat

Re: Saving alert triggerred scripts inside apps

ewoo — Tue, 18 May 2010 07:24:25 GMT

The script should actually be placed directly in /etc/apps/[appname]/bin. Files in a 'script' subdirectory of 'bin' are probably ignored.

Re: Saving alert triggerred scripts inside apps

the_wolverine — Thu, 10 Jun 2010 01:09:40 GMT

Leo, this doesn't appear to work, at least in version 4.1.2. When I create a script (verified executable) in $SPLUNK_HOME/etc/apps/myapp/bin/ and create a scheduled search (also running out of myapps/local/savedsearch.conf) that triggers the script, I still see that Splunk is looking in $SPLUNK_HOME/bin/scripts for the script:

ERROR script - Cannot find script at /home/support/splunk/bin/scripts/myscript.sh

What am I missing to get it to run from my app's bin directory?

Re: Saving alert triggerred scripts inside apps

Leo — Thu, 10 Jun 2010 02:08:30 GMT

Actually I'm trying this now on 4.1.3 and it doesn't work when the script is placed in either script or bin directory.

Re: Saving alert triggerred scripts inside apps

Ledion_Bitincka — Thu, 10 Jun 2010 04:44:13 GMT

the alert script should be placed in:

$SPLUNK_HOME/etc/apps/<app>/bin/scripts/

The error message you're seeing occurs because splunk first looks in the above app level directory and then falls back to the system level script location $SPLUNK_HOME/bin/scripts/ - if a script is not found at the system level a failure is reported and the system level dir is output.