topic Re: Basics around alert actions in Alerting

Basics around alert actions

CrookC007 — Mon, 27 Nov 2017 13:34:14 GMT

Hi,

I have not been working with Splunk for long but I have come across a lot of issues trying to get it to trigger a custom script. I then noted that the 'feature' had been deprecated and in the resulting searching came across people talking about creating custom alert actions.

In my head this seems to suggest that the original way is left in for legacy so defining a new one is your best bet. Am I right here?

I had a quick look in the alert_actions.conf and found the stanza for the original function. If you were to try and create your own how would it be any different? When I say different I mean in order to get it to work.

I personally think I have made assumptions that are incorrect around why you would want to create a customer alert action in the first place. Looking at it at all is driven purely through frustration in not being able to run my shell script.

Re: Basics around alert actions

woodcock — Mon, 27 Nov 2017 15:10:50 GMT

It all still works. It has been deprecated (but not disabled/removed and I am sure that it never will be). I still use it when I am in a hurry and it works fine. The GUI front-end has hidden it but you can still add it from CLI and it still works the same as always. The "right" thing to do is to create a custom modular alert that is multi-processor/platform compatible but that takes much longer.

Re: Basics around alert actions

CrookC007 — Mon, 27 Nov 2017 15:27:03 GMT

Interesting thanks. I will have to try a few more things to try and make mine do something then (or stick with cron).

Re: Basics around alert actions

CrookC007 — Mon, 27 Nov 2017 15:28:07 GMT

BTW I tried to award points but it would leave me unable to post any more questions apparently.

Re: Basics around alert actions

woodcock — Mon, 27 Nov 2017 15:38:34 GMT

Check my position on the leaderboard; I don't need the points (but appreciate your generosity)!

Re: Basics around alert actions

woodcock — Mon, 27 Nov 2017 15:39:12 GMT

You can always upvote to spread Karma for free. I upvoted some of your stuff in this Q/A so should have more Karma now!

Re: Basics around alert actions

starcher — Mon, 27 Nov 2017 20:42:38 GMT

Making alerts using the Add-On builder is the best way these days. You have to get used to it. But once you do, things become much easier.

https://splunkbase.splunk.com/app/2962/