- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Basics around alert actions
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have not been working with Splunk for long but I have come across a lot of issues trying to get it to trigger a custom script. I then noted that the 'feature' had been deprecated and in the resulting searching came across people talking about creating custom alert actions.
In my head this seems to suggest that the original way is left in for legacy so defining a new one is your best bet. Am I right here?
I had a quick look in the alert_actions.conf and found the stanza for the original function. If you were to try and create your own how would it be any different? When I say different I mean in order to get it to work.
I personally think I have made assumptions that are incorrect around why you would want to create a customer alert action in the first place. Looking at it at all is driven purely through frustration in not being able to run my shell script.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It all still works. It has been deprecated (but not disabled/removed and I am sure that it never will be). I still use it when I am in a hurry and it works fine. The GUI front-end has hidden it but you can still add it from CLI and it still works the same as always. The "right" thing to do is to create a custom modular alert that is multi-processor/platform compatible but that takes much longer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It all still works. It has been deprecated (but not disabled/removed and I am sure that it never will be). I still use it when I am in a hurry and it works fine. The GUI front-end has hidden it but you can still add it from CLI and it still works the same as always. The "right" thing to do is to create a custom modular alert that is multi-processor/platform compatible but that takes much longer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Interesting thanks. I will have to try a few more things to try and make mine do something then (or stick with cron).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Making alerts using the Add-On builder is the best way these days. You have to get used to it. But once you do, things become much easier.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW I tried to award points but it would leave me unable to post any more questions apparently.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check my position on the leaderboard; I don't need the points (but appreciate your generosity)!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can always upvote to spread Karma for free. I upvoted some of your stuff in this Q/A so should have more Karma now!
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
