Alerting

Alert Script in App

AlexMcDuffMille
Communicator

Hello,

I am currently able to successfully have a script execute after a search when located in $SPLUNK_HOME/bin/scripts. However, I would like to have my scripts be separated by apps. I have the script located now in $SPLUNK_HOME/etc/my_app_name/bin/scripts, but it doesn't work.

I've also put it in $SPLUNK_HOME/etc/apps/my_app_name/bin/scripts and have not succeeded.

Does anyone know how to get a script to work just in the context of an app?

Thanks!

0 Karma
1 Solution

linu1988
Champion

Hello,
The directories are correct. Which OS and version of splunk are you using? Did you check if there is any dependency of path in the script itself? i have scripts running from the app itself. And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory.

Thanks

View solution in original post

0 Karma

linu1988
Champion

Hello,
The directories are correct. Which OS and version of splunk are you using? Did you check if there is any dependency of path in the script itself? i have scripts running from the app itself. And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory.

Thanks

0 Karma

AlexMcDuffMille
Communicator

$SPLUNK_HOME/etc/apps/my_app_name/bin/scripts is the correct directory.

0 Karma

linu1988
Champion

yes it should work as expected then. Please go and check in the python.log in log folder what is the error you are getting when the search triggers the script?

0 Karma

AlexMcDuffMille
Communicator

well it's in the savedsearches.conf in the app folder, is that what you mean?

0 Karma

linu1988
Champion

I meant the saved search which triggers the script should be present in the respective app folder rather than search app. Could you try that?

0 Karma

AlexMcDuffMille
Communicator

Hello,

I am running Splunk version 5.0.3, build 163460 on Ubuntu 12.04.2.

I do not see any dependency of the script itself. It works fine when I put it in $SPLUNK_HOME/etc/my_app_name/bin/scripts

I don't understand this, did you mean to say "script" instead of "search"?
"And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory."

Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...