topic Re: Run Script Alert in Alerting

Run Script Alert

arun_kant_sharm — Tue, 16 Jul 2019 06:20:00 GMT

How to run a script with a alert action?
Example I want to disable a Splunk App if the daily license usage is more than 80%, but when I try to run script on that alert it shows that message "
The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead.
"
Please guide what is the proper way to do it.

Re: Run Script Alert

arun_kant_sharm — Wed, 30 Sep 2020 01:19:00 GMT

I am using below search string:

source=*license_usage.log type="RolloverSummary" earliest=@d | stats sum(b) AS used max(stacksz) AS quota by _time | eval usedGB=round(used/1024/1024/1024,3) | eval quotaGB=round(quota/1024/1024/1024,3) | eval percentage=round(usedGB / quotaGB, 3)*100 | table _time usedGB, quotaGB, percentage, used, quota | where percentage > 80

What is the right way to trigger script with a alert ?

Re: Run Script Alert

harsmarvania57 — Tue, 16 Jul 2019 08:53:19 GMT

Hi,

"Run a script" alert action is deprecated, you need to move to new framework called "Custom Alert Action". Have a look at document https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsIntro and you'll get idea.