topic Re: splunk failing to fire a scripted alert in Alerting

splunk failing to fire a scripted alert

tympaniplayer — Thu, 27 Oct 2011 17:55:06 GMT

Hi, I am using a windows batch file to launch a program called bmail to connect to a server to send an email when the alert is triggered. The script is in the correct directory ( splunk\ bin\ scripts). When the program is run manually it works fine. Something I am missing?

Re: splunk failing to fire a scripted alert

jbsplunk — Thu, 27 Oct 2011 19:00:32 GMT

A couple of questions:

Are the criteria for the action you expect to be executed happening in the results?

Did you check your secheduler.log to ensure that the script actually did fire when you expected it to fire?

The log is in $SPLUNK_HOME/var/log/splunk/. I usually check here to see if the script was actually fired. If it was, the firing of the script is performed by python, so you may way to check the python.log to see if anything interesting pops up there.

Re: splunk failing to fire a scripted alert

tympaniplayer — Thu, 27 Oct 2011 19:10:48 GMT

in splunkd.log i get this
'bmail' is not recognized as an internal or external command.

why would it work when i do it manually, but not work when splunk shoots it off?

they python log says it is firing it is as well. No luck

Re: splunk failing to fire a scripted alert

Lamar — Thu, 27 Oct 2011 20:29:05 GMT

Is the user that runs Splunk the same user you're using to manually execute the script?

You may not have the same environment variables for each user which might allow you to execute the bmail executable.

Just curious.

Re: splunk failing to fire a scripted alert

tympaniplayer — Fri, 28 Oct 2011 18:48:00 GMT

Same user executing manually as is running splunk. Checked scheduler.log, everything is firing like it is supposed to. nothing interesting in python.log it says its fired in there as well.