Alerting

Can a script (alert action) add information to an alert?

maratc
Engager

I have created my own alert action that receives information from Splunk. The action is added to an existing alert. The alert is real-time, triggered per result.

The action goes to another service to pull more information (think of geo-location service that provides lat/long information provided the IP). I would like to add this additional information back to the alert.

How can I do it?

0 Karma
1 Solution

lguinn2
Legend

There is no way to edit an data that is already indexed in Splunk.

However you could do this:
1. Have your alert action take the information from Splunk and then the results from the service, then write all of this to a new log file.
2. Splunk the new log file.
3. Write searches in Splunk that combine the original information with the new log file information.

OR, you could use the Splunk KV store. Instead of writing all the stuff to a new log file, place an entry in a KV store collection. Then use the KV store collection as part of searches.

Regardless of approach (log file or KV store), be sure to add enough of the original information to the entry so that it can be correlated properly.

View solution in original post

0 Karma

lguinn2
Legend

There is no way to edit an data that is already indexed in Splunk.

However you could do this:
1. Have your alert action take the information from Splunk and then the results from the service, then write all of this to a new log file.
2. Splunk the new log file.
3. Write searches in Splunk that combine the original information with the new log file information.

OR, you could use the Splunk KV store. Instead of writing all the stuff to a new log file, place an entry in a KV store collection. Then use the KV store collection as part of searches.

Regardless of approach (log file or KV store), be sure to add enough of the original information to the entry so that it can be correlated properly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...