Alerting
Highlighted

Alert Script is not running?

New Member

I created an alert, it is working fine. When I echo into a "echo_output.sh" file, it works fine. When I'm trying to echo the same content on the console, nothing happens. When I manually execute the file ( instead of, from the splunk) it runs as expected.

Here is the link for another question, this question also has the same issue as my question.
http://answers.splunk.com/answers/92958/alert-script-not-running-splunk.html

I hope to get some help soon.

0 Karma
Highlighted

Re: Alert Script is not running?

Contributor

Hi, Splunk will launch scripts from within it's runtime env. Does your scripts run if you run them from splunk cmd line?

    cd  to splunk_home (wherever splunk is installed)
    cd bin
    ./splunk cmd path_to_your_script/echo_output.sh
0 Karma
Highlighted

Re: Alert Script is not running?

New Member

Yes, I just checked. I get the expected output when I use "./splunk cmd pathtoyourscript/echooutput.sh"

0 Karma
Highlighted

Re: Alert Script is not running?

Contributor

Ok. I might have misunderstood your question. Are to trying to send off an alert to STDOUT from within splunk (using splunk scheduler)?

0 Karma
Highlighted

Re: Alert Script is not running?

New Member

I want to disable the input from the console when an alert is generated.

For disabling the output, I need to "cd to the directory" where input.conf file is present and change the "disable=false" to true. I want to do this using the script which runs when I get an alert. I need my script to work on the console.

0 Karma
Highlighted

Re: Alert Script is not running?

SplunkTrust
SplunkTrust

Do you have the hashbang at the top of your script?

0 Karma
Highlighted

Re: Alert Script is not running?

Contributor

If your use case is to disable an input (x) on a triggered alert (y)... are you using generic cmds to make this change (sed,awk etc ) or splunk CLI?
You are essentially trying to change a config that is already active within the session. Typically making such a change via CLI (eg: splunk edit monitor) would prompt for user and password. Additionally you need to have a way to reload the config after your change. Were you planning on use a REST call for this?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.