topic Scripted Alert to third party event managemet in Alerting

Scripted Alert to third party event managemet

bizza — Mon, 28 Sep 2020 17:05:14 GMT

Hi,
we are setting up some alerts based on a vendor script to automatically populate an Event Management Console.
The problem is that we need to extract some informations (=fileds) from Splunk raw data included in the alert to pass it as a parameter to the script itself, so we will be able to pupulate correctly the Event management console.

Example syntax:

custom_bin.sh -n @event.management.console:port -b host_extracted_from_splunk_data -u user_extracted_from_splunk_data

where:

custom_bin.sh is our third party script

-n @event.management.console:port is the event management console fqdn:port

-b host_extracted_from_splunk_data is the host field indexed by splunk present in the specific record we need to extract to

-u user_extracted_from_splunk_data is the user filed extracted ... like the host field

Any hint on how we can achieve it?

Regards

Re: Scripted Alert to third party event managemet

martin_mueller — Wed, 16 Jul 2014 13:04:28 GMT

The eighth parameter passed to the alert script is a path to the search results. You can examine those to extract whatever info you need. http://wiki.splunk.com/Community:Use_Splunk_alerts_with_scripts_to_create_a_ticket_in_your_ticketing_system

Re: Scripted Alert to third party event managemet

bizza — Wed, 16 Jul 2014 13:19:43 GMT

Hi Martin, thank for your answer.
I need to extract from results some fields and use they as a parameter for the third party script.
Something like the host, the username for example.
Do you know if it's possible?

regards

Re: Scripted Alert to third party event managemet

martin_mueller — Wed, 16 Jul 2014 14:17:36 GMT

The path points at a gzipped CSV file, you can pick whatever field you need from that.

Re: Scripted Alert to third party event managemet

bizza — Thu, 17 Jul 2014 10:05:40 GMT

thanks martin, i solved just parsing the csv with a perl script.

Re: Scripted Alert to third party event managemet

rsiekermann_spl — Fri, 24 Jul 2015 14:03:01 GMT

Hi Martin,

do you have an example of the script you have been using here?

Regards

Re: Scripted Alert to third party event managemet

rcorbisier_splu — Wed, 21 Oct 2015 19:29:45 GMT

The Splunk Developer’s Guide and the accompanying Splunk Reference App might be helpful in answering your question. The book is available in both paperback and Mobi from Amazon.

It was designed by a Splunk dev team to help you learn how to build, test, and deploy apps - The reference app (named PAS) showcases proven practices using the Splunk Developer Platform and includes code that you can download, reuse and even contribute to, code walkthroughs as well as the associated unit and acceptance tests.

The featured example demonstrates how to monitor various document repositories (current and future). Managers and auditors can use the app to see who has viewed, modified, deleted, or downloaded documents or other artifacts from various sources, detect suspicious behaviors, and analyze trends.

Currently an updated version is under development that will expand the functionality, so even if it’s not relevant now you might want to keep checking to see what’s been added.