Call CURL on Alert

[rtadams89]

I would like to have Splunk send a GET request to a web page whenever an alert is triggered. I can do this from the Splunk server's CLI with

curl "http://somesite.int/page.html"

If I put that same command into the "run a script" box on the saved search page, nothing happens. Is there any way for me to call a script/executable (in this case "curl") from the Splunk saved search? If not, does anyone have an example of a script I could create in the $SPLUNK_HOME/bin/scripts/ directory and call which would allow me to pass the address ("http://somesite.int/page.html" in this example) to curl from the saved search configuration?

[Malay123]

<a href="https://www.google.com">HTML</a>

[Damien_Dallimor]

You could just take the curl command , wrap it in a shell script, put that shell script in the $SPLUNK_HOME/bin/scripts directory ,chmod it to executable, and then reference this script in the "run a script box" on the alert configuration page.

There are also several parameters that Splunk passes to the script that you could potentially make use of.Refer to this link for details.

Example script :

#!/bin/sh
### ====================================================================== ###
##                                                                          ##
##  Curl Wrapper                                                            ##
### ====================================================================== ###

curl "http://somesite.int/page.html"

[Damien_Dallimor]

With current functionality , you can't pass custom arguments to the script, as alluded to in this other answer ,http://splunk-base.splunk.com/answers/25181/alerts-and-scripts-with-parameters

I have tackled a similar situation with a custom SMS alerting script I wrote, where parameters need to be passed by the triggered alert ie: the target cellphone number.

So I have 1 main alerting script that is wrapped by several other 1 liner scripts that pass the the parameter in.And users can then specify the wrapper script in the alert configuration. Not 100% ideal, but a functional workaround.

[rtadams89]

That's a start, and I already got about that far. The problem is that I want the user who sets the alert through the GUI to be able to customize the URL that is called (not have it hard coded in the script). I'm looking for a way to not only call curl, but to pass the URL parameter to it.