topic Activate heavy forwarder upon alert in Alerting

Activate heavy forwarder upon alert

tonyArad — Fri, 06 Sep 2013 07:03:15 GMT

Hi,

How can I activate my heavy forwarder upon alert?
My goal is to send out data from Splunk to an external server when event occur.

Thanks!
Tony

fbl_itcs — Fri, 06 Sep 2013 07:59:27 GMT

Hi,

you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).

tonyArad — Fri, 06 Sep 2013 12:07:41 GMT

Thanks!
Do you have an example of such script by chance?

fbl_itcs — Fri, 06 Sep 2013 12:14:38 GMT

Not really. It really depends what kind of systems you are using. If it is a heavy forwarder on a Linux system it is nothing more than

"ssh splunk@computername "/opt/splunk/bin/splunk start""

Ofc. you need a passwordless login (e.g. using a key) for this to work.