topic Re: How to pass hostname to a custom alert script? in Alerting

How to pass hostname to a custom alert script?

jpolcari — Mon, 06 Jun 2016 15:47:06 GMT

I have an alert setup that finds an error which indicates that a service must be restarted. When the alert triggers, I would like for a script to run that restarts the service on the specific host that service failed on. I saw in the link below that you can pass custom arguments such as a fieldvalue. Is it possible to pass these arguments to a script? I'm interested in grabbing the hostname of the system so I can reference it in my script. This is a Windows environment so I would most likely be using a .bat file to restart the service.

http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/ModAlertsLog

Re: How to pass hostname to a custom alert script?

somesoni2 — Mon, 06 Jun 2016 16:14:33 GMT

Do you have host name (where the service failed) available as a field in your resultset? If you do, you can use $result.<hostfieldname>$ in your script.

Re: How to pass hostname to a custom alert script?

jkat54 — Mon, 06 Jun 2016 16:20:42 GMT

This is worth a bookmark too: http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Configuringscriptedalerts

Re: How to pass hostname to a custom alert script?

jpolcari — Mon, 06 Jun 2016 17:25:49 GMT

Thank you, the host name is available. I'll give this a shot.

Re: How to pass hostname to a custom alert script?

jpolcari — Mon, 06 Jun 2016 18:33:09 GMT

I attempted to add $result.host$ to the .bat and just have the script print it to a file. The script ran but it only printed "$result.host$" to the text document. I also tried the same but with % isntead of $ but that time it only printed Echo is on. Am I missing something? The script is placed in %SPLUNK_HOME%\bin\scripts.

Re: How to pass hostname to a custom alert script?

jpolcari — Tue, 14 Jun 2016 17:52:42 GMT

Still having some issues with this. Any ideas?

Re: How to pass hostname to a custom alert script?

Cuyose — Tue, 29 Sep 2020 13:13:58 GMT

I figured this out. in order for these variables to be used from the resultset I had to declare these variables in the alert_actions.conf, then restart. I then could add the information by calling the variable value with setting.get from the action script.

alert_actions.conf
param.results_team = $result.team$

action.py
team = settings.get('results_team')

Re: How to pass hostname to a custom alert script?

jashman — Tue, 05 Dec 2017 00:57:50 GMT

Hi Cuyose,
I am trying something similar to this and am having trouble getting the variable to pass across. Do you mind sharing some more of the code in action.py so we can see how this is done?

Re: How to pass hostname to a custom alert script?

alvaro_garcia — Wed, 20 Dec 2017 11:32:48 GMT

any update?

Re: How to pass hostname to a custom alert script?

AniPrag — Sun, 05 Aug 2018 07:27:01 GMT

Any update ?

Re: How to pass hostname to a custom alert script?

AniPrag — Sun, 05 Aug 2018 11:55:44 GMT

Any update

Re: How to pass hostname to a custom alert script?

AniPrag — Sun, 05 Aug 2018 11:57:26 GMT

did you get any answer

Re: How to pass hostname to a custom alert script?

jkat54 — Sun, 05 Aug 2018 12:22:49 GMT

Since Cuyose’s script was executing on a full splunk server (not a UF/LWF), Cuyose had python at hid disposal and didn’t use a .bat file. Instead he used python and the documentation found here to create a custom alert action.

http://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ModAlertsIntro

To do this with a batch script, you have to use the results gzip tar file and your own code to pull fields out.

The tar.gz is explained here: https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Configuringscriptedalerts

You’re wasting your time doing this in batch scripts if you ask me... you should be doing a python mod alert or SPL command.

Re: How to pass hostname to a custom alert script?

AniPrag — Tue, 29 Sep 2020 20:47:43 GMT

Thanks for responding, However the problem is not resolved yet
In alert_actions.conf ($Splunk_Home$\etc\system\local) file i am adding below
param.name = $result.HostName$
but its showing invalid stanza and i am calling the same in script as shown below
hostname=settings.get(name)

but still the stanze problem is not done..
m i doing some thing wrong...

Re: How to pass hostname to a custom alert script?

jkat54 — Sun, 05 Aug 2018 14:14:35 GMT

My apologies, I thought the original poster answered their own question.

Re: How to pass hostname to a custom alert script?

jkat54 — Sun, 05 Aug 2018 14:16:01 GMT

If you want help I suggest you post your own question and show the code you’re using too. We can’t troubleshoot two issues on one thread as these may be very different custom code problems.