Activate heavy forwarder upon alert

[tonyArad]

Hi,

How can I activate my heavy forwarder upon alert?
My goal is to send out data from Splunk to an external server when event occur.

Thanks!
Tony

[fbl_itcs · Accepted solution]

Hi,

you could execute a script when the alert fires. The script then could start the heavy forwarder (in unix e. g. using ssh).

[fbl_itcs]

Not really. It really depends what kind of systems you are using. If it is a heavy forwarder on a Linux system it is nothing more than

"ssh splunk@computername "/opt/splunk/bin/splunk start""

Ofc. you need a passwordless login (e.g. using a key) for this to work.

[tonyArad]

Thanks!
Do you have an example of such script by chance?