Alerting

Alert Script is not running?

shreyasj
New Member

I created an alert, it is working fine. When I echo into a "echo_output.sh" file, it works fine. When I'm trying to echo the same content on the console, nothing happens. When I manually execute the file ( instead of, from the splunk) it runs as expected.

Here is the link for another question, this question also has the same issue as my question.
http://answers.splunk.com/answers/92958/alert-script-not-running-splunk.html

I hope to get some help soon.

0 Karma

Yasaswy
Contributor

Hi, Splunk will launch scripts from within it's runtime env. Does your scripts run if you run them from splunk cmd line?

    cd  to splunk_home (wherever splunk is installed)
    cd bin
    ./splunk cmd path_to_your_script/echo_output.sh
0 Karma

shreyasj
New Member

Yes, I just checked. I get the expected output when I use "./splunk cmd path_to_your_script/echo_output.sh"

0 Karma

Yasaswy
Contributor

Ok. I might have misunderstood your question. Are to trying to send off an alert to STDOUT from within splunk (using splunk scheduler)?

0 Karma

shreyasj
New Member

I want to disable the input from the console when an alert is generated.

For disabling the output, I need to "cd to the directory" where input.conf file is present and change the "disable=false" to true. I want to do this using the script which runs when I get an alert. I need my script to work on the console.

0 Karma

Yasaswy
Contributor

If your use case is to disable an input (x) on a triggered alert (y)... are you using generic cmds to make this change (sed,awk etc ) or splunk CLI?
You are essentially trying to change a config that is already active within the session. Typically making such a change via CLI (eg: splunk edit monitor) would prompt for user and password. Additionally you need to have a way to reload the config after your change. Were you planning on use a REST call for this?

0 Karma

starcher
SplunkTrust
SplunkTrust

Do you have the hashbang at the top of your script?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...