Alerting

Basics around alert actions

Explorer

Hi,

I have not been working with Splunk for long but I have come across a lot of issues trying to get it to trigger a custom script. I then noted that the 'feature' had been deprecated and in the resulting searching came across people talking about creating custom alert actions.

In my head this seems to suggest that the original way is left in for legacy so defining a new one is your best bet. Am I right here?

I had a quick look in the alert_actions.conf and found the stanza for the original function. If you were to try and create your own how would it be any different? When I say different I mean in order to get it to work.

I personally think I have made assumptions that are incorrect around why you would want to create a customer alert action in the first place. Looking at it at all is driven purely through frustration in not being able to run my shell script.

1 Solution

Esteemed Legend

It all still works. It has been deprecated (but not disabled/removed and I am sure that it never will be). I still use it when I am in a hurry and it works fine. The GUI front-end has hidden it but you can still add it from CLI and it still works the same as always. The "right" thing to do is to create a custom modular alert that is multi-processor/platform compatible but that takes much longer.

View solution in original post

0 Karma

Esteemed Legend

It all still works. It has been deprecated (but not disabled/removed and I am sure that it never will be). I still use it when I am in a hurry and it works fine. The GUI front-end has hidden it but you can still add it from CLI and it still works the same as always. The "right" thing to do is to create a custom modular alert that is multi-processor/platform compatible but that takes much longer.

View solution in original post

0 Karma

Explorer

Interesting thanks. I will have to try a few more things to try and make mine do something then (or stick with cron).

0 Karma

SplunkTrust
SplunkTrust

Making alerts using the Add-On builder is the best way these days. You have to get used to it. But once you do, things become much easier.

https://splunkbase.splunk.com/app/2962/

Explorer

BTW I tried to award points but it would leave me unable to post any more questions apparently.

Esteemed Legend

Check my position on the leaderboard; I don't need the points (but appreciate your generosity)!

0 Karma

Esteemed Legend

You can always upvote to spread Karma for free. I upvoted some of your stuff in this Q/A so should have more Karma now!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!