topic Re: Splunk Powershell Scripted Alert in Alerting

Splunk Powershell Scripted Alert

gdavid — Wed, 06 Nov 2013 16:43:19 GMT

I am trying to use a powershell scripted alert.

I came up with the scripted alert

call_powershell.bat

which contains:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -File "E:\Program Files\Splunk\bin\scripts\Script1.ps1"

the problem with this is that i don't seem to have access to the environmental variables to grab the attached csv for the results.

anyone able to run a scripted powershell alert?

thanks

Re: Splunk Powershell Scripted Alert

halr9000 — Wed, 06 Nov 2013 17:12:18 GMT

Your script should inherit the environment from the parent process. Try enumerating $env:, it's a special variable that contains the env vars. you would access it like this:

$env:VarName

So, to get your windows install folder, that would be $env:windir. There are many docs and posts about this topic, here's one: http://technet.microsoft.com/en-us/library/ff730964.aspx

HTH, let us know

Re: Splunk Powershell Scripted Alert

sdaniels — Wed, 06 Nov 2013 17:12:48 GMT

Have you used the Powershell resource kit that is referenced in this blog?

http://blogs.splunk.com/2012/02/04/powershell-resource-kit-for-splunk/

Re: Splunk Powershell Scripted Alert

halr9000 — Wed, 06 Nov 2013 17:17:34 GMT

That won't help with an alert driven by a Splunk search. Today, the only options for an alert action are email or script. The resource kit is cool, though, as is the PowerShell addon, which every Splunk Windows shop needs to see http://apps.splunk.com/app/1477/

Re: Splunk Powershell Scripted Alert

linu1988 — Mon, 28 Sep 2020 15:13:27 GMT

Where did you pass the environment variables? the bat file should contain the "%SPLUNK_ARG_7%", "%SPLUNK_ARG_8%" which passes the csv /search id? I dont know how you are getting the result and emailing but this should be passed to .ps1 script to make any splunk result manipulation.

Check with Splunk\bin\scripts echo.bat and try to work again.

Re: Splunk Powershell Scripted Alert

halr9000 — Wed, 06 Nov 2013 17:48:42 GMT

Combining comment from @linu1988 and my answer should get you there.

Re: Splunk Powershell Scripted Alert

linu1988 — Sun, 17 Nov 2013 18:26:57 GMT

This should be set in bat file.

C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -NoProfile -File "E:Program FilesSplunkbinscriptsScript1.ps1" "%SPLUNK_ARG_0%", "%SPLUNK_ARG_1%", "%SPLUNK_ARG_2%", "%SPLUNK_ARG_3%", "%SPLUNK_ARG_4%", "%SPLUNK_ARG_5%", "%SPLUNK_ARG_6%", "%SPLUNK_ARG_7%", "%SPLUNK_ARG_8%"

then in ps script $args[i], as per need.