Alert Script in App

[AlexMcDuffMille]

Hello,

I am currently able to successfully have a script execute after a search when located in $SPLUNK_HOME/bin/scripts. However, I would like to have my scripts be separated by apps. I have the script located now in $SPLUNK_HOME/etc/my_app_name/bin/scripts, but it doesn't work.

I've also put it in $SPLUNK_HOME/etc/apps/my_app_name/bin/scripts and have not succeeded.

Does anyone know how to get a script to work just in the context of an app?

Thanks!

[linu1988 · Accepted solution]

Hello,
The directories are correct. Which OS and version of splunk are you using? Did you check if there is any dependency of path in the script itself? i have scripts running from the app itself. And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory.

Thanks

[AlexMcDuffMille]

$SPLUNK_HOME/etc/apps/my_app_name/bin/scripts is the correct directory.

[linu1988]

yes it should work as expected then. Please go and check in the python.log in log folder what is the error you are getting when the search triggers the script?

[AlexMcDuffMille]

well it's in the savedsearches.conf in the app folder, is that what you mean?

[linu1988]

I meant the saved search which triggers the script should be present in the respective app folder rather than search app. Could you try that?

[AlexMcDuffMille]

Hello,

I am running Splunk version 5.0.3, build 163460 on Ubuntu 12.04.2.

I do not see any dependency of the script itself. It works fine when I put it in $SPLUNK_HOME/etc/my_app_name/bin/scripts

I don't understand this, did you mean to say "script" instead of "search"?
"And Make sure the search also moved to the respective app. e.g. if you have your search is placed in search app it will be able to find it in global bin/script directory but it won't look into your_app directory."

Thanks for your help!