Alerting

Can I manually trigger a scripted alert

chris
Motivator

Is it somehow possible to trigger a scripted alert manually?

We have some alerts that usually run once a day, sometimes there is a need to run the scripted alert more often ( to either manually check if a situation occured based on some information the users receive or to simply check whether the shell script is still working correctly). I know, that I can change the alert to run every minute in the manager and then change it back to what the intervall was. If I just click on the 'run' action in the manager only the search is run but the shell script (or email-action) is not triggered. Is there a way to do this?

Chris

1 Solution

Lowell
Super Champion

You have to somehow pass triggerActions=1 when the search job get's created. Otherwise, as you've seen, the search will run as normal, but without causing any of the triggered actions (like running a script, emailing, or summary indexing) to occur. Normally, this is what you want. For example, you wouldn't want to accidentally click "run" on a summary index generating search that would end up doubling up your summary index data. In the case, of sending an email though, that would be nice to be able to do.

I don't know a way to do this from within the user interface, but I've done it from some python code before, here's a stripped down version that works on my system. Obviously, you'll need to update it to match your parameters. You can change "now" to any epoch time, to re-test at a specific time after tweaking the alert's logic.

import splunk.auth
import splunk.saved
import time

sessionKey  = splunk.auth.getSessionKey("admin", "changeme")
now = time.time()

job = splunk.saved.dispatchSavedSearch("Savesearch name", sessionKey=sessionKey, namespace="App", owner="admin", triggerActions=1, now=now)

The REST API docs also show an example using curl:

curl -k -u admin:pass \
  https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch/dispatch \
  -d trigger_actions=1

View solution in original post

Lowell
Super Champion

You have to somehow pass triggerActions=1 when the search job get's created. Otherwise, as you've seen, the search will run as normal, but without causing any of the triggered actions (like running a script, emailing, or summary indexing) to occur. Normally, this is what you want. For example, you wouldn't want to accidentally click "run" on a summary index generating search that would end up doubling up your summary index data. In the case, of sending an email though, that would be nice to be able to do.

I don't know a way to do this from within the user interface, but I've done it from some python code before, here's a stripped down version that works on my system. Obviously, you'll need to update it to match your parameters. You can change "now" to any epoch time, to re-test at a specific time after tweaking the alert's logic.

import splunk.auth
import splunk.saved
import time

sessionKey  = splunk.auth.getSessionKey("admin", "changeme")
now = time.time()

job = splunk.saved.dispatchSavedSearch("Savesearch name", sessionKey=sessionKey, namespace="App", owner="admin", triggerActions=1, now=now)

The REST API docs also show an example using curl:

curl -k -u admin:pass \
  https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch/dispatch \
  -d trigger_actions=1
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...