topic Splunk Alert Script on Windows in Alerting

Splunk Alert Script on Windows

gdavid — Wed, 25 Sep 2013 15:27:19 GMT

I am trying to find info on how to write a custom alert script in python on windows.

Initially i thought i would write a custom email script to modify some fields and subject lines etc to create tickets via email.
Based on this script, i could later create a ticket directly with my ticketing platform.

I can't seem to find any info on the scripts and modules available to splunk internally (ex: email). I see the SDKs for various languages but this seems to be from outside splunk. What if i want to leverage a script inside splunk and just use the same modules? i know i could rip apart the current sendemail.py, it just seems like this might be documented already somewhere.

Also there is so no clear indication for me on how to get the results of a search alert into my script.
There is an article here on how to do this, but it seems not to be for windows.
http://www.seanelavelle.com/2012/04/11/scripting-splunk-alerts-with-python/

thanks

Re: Splunk Alert Script on Windows

MartinMcNutt — Wed, 25 Sep 2013 18:25:39 GMT

I am currently trying to do the same but with powershell. I want to execute a script to update a users attribute if value/Alert is triggered.

I found this document which I have been using to start working on it.

ConfiguringScriptedAlerts

Re: Splunk Alert Script on Windows

gdavid — Wed, 25 Sep 2013 23:30:09 GMT

right i saw that page, but it still leaves me with a ton of questions. so in order to use python, they have this block:

to use Python to interpret the script file:
'---- myscript.py -----
'#!/path/to/python
'.....
'.....

does this mean that i need to install my own version of python? or is there a way to point it to the version installed with splunk?