topic Why is triggering an alert not running the script? in Alerting

Why is triggering an alert not running the script?

redouane_prx — Fri, 13 Apr 2018 11:46:46 GMT

Hi,

It's been two days and I'm trying to solve this problem, I'm quite new to splunk and I want to run a script from a triggred alarm.

I've configured an alarm to execute two action:
1) send an email
2) run a script

I do receive the email but the shell script is not executed, the log file (splunkd.log) shows this error:

rt_scheduler__admin__search__RMD5311cfcc34c99c9e6_at_1523539181_68344.1380 command="runshellscript", Script: /opt/splunk/bin/scripts/ exited with status code: 1

I tried Script trouble shooting but it didn't help.

I'm using the version 6.5.3 of splunk.

Hope you can help me with this.

Re: Why is triggering an alert not running the script?

Sukisen1981 — Fri, 13 Apr 2018 18:25:34 GMT

Hi refer this thread here - https://answers.splunk.com/answers/329819/alert-manager-script-exit-status-1.html
Looks like an issue with the script target . It could be an issue with the privileges that splunk needs to access your script target

Re: Why is triggering an alert not running the script?

DalJeanis — Fri, 13 Apr 2018 20:16:11 GMT

I've also seen times when status code 1 was a badly written python script. wrong number of spaces on a line if I recall correctly.

Re: Why is triggering an alert not running the script?

MuS — Fri, 13 Apr 2018 22:31:03 GMT

As mentioned by @DalJeanis, this is most likely related to the script being not correct. Try running it like Splunk would:

Start a Splunk shell: /opt/splunk/bin/splunk /bin/bash
In this shell start the script: /opt/splunk/bin/splunk cmd <scriptnamehere> and see what happens

cheers, MuS

Re: Why is triggering an alert not running the script?

redouane_prx — Mon, 16 Apr 2018 08:52:15 GMT

Thank you guys, the problem is solved. the issue indeed was with the script and Splunk shell didn't have the necessary libraries (OPENSSL_1.0.1) to execute it.

Re: Why is triggering an alert not running the script?

logloganathan — Mon, 16 Apr 2018 13:03:38 GMT

thanks for providing the solution

Re: Why is triggering an alert not running the script?

sagar0907 — Mon, 25 Nov 2019 09:45:47 GMT

where do we need the libraries and which libraries we need to place in order to run the shell script/sql