Alerting

Can not run a simple action script

teknet9
Path Finder

Hello Team,

Troubleshooting for few hours the most basic script executed as the action.

Trying manually (search returning ~90 results):
sourcetype="cisco:ios" | runshellscript create_inc.sh arg1 arg2 arg3 arg4 arg5 arg6 arg7 "/tmp/test"
got the response: create_inc.sh exited with status code: 1

The script create_inc.sh content:
cp $8 >/tmp/ttt
(script is executable)

I have /tmp/test readable by all.
As a result i see /tmp/ttt created (it was not existing) but it's empty. Why ?

I want to write mode advanced script like this one:
https://answers.splunk.com/answers/149836/how-to-run-an-alert-script-on-field-values-generated-in-sp...

But can not get the simplest script tested. I have followed troubleshooting guide:
http://wiki.splunk.com/Community:TroubleshootingAlertScripts
But it's not really helpful.

Could you please help me with this most basic script ?

Thanks,
Michal

0 Karma

damien_chillet
Builder

Hi teknet9,

It is described in Splunk docs that runshellscript is not a supported search command:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Runshellscript
This is most likely why your method does not work. arg8 is supposed to be the path to the search results passed by Splunk, and you are manually providing a path where the results should not be.

To test your script I would suggest setting up an alert with a script action (your script).

0 Karma

teknet9
Path Finder

Sorry, a small update, i had a typoo in my script,
now i have:
sourcetype="cisco:ios" | runshellscript create_inc.sh arg1 arg2 arg3 arg4 arg5 arg6 arg7 "/tmp/test.gz"

Exiting with code 2.

While if i execute from shell:
./create_inc.sh arg1 arg2 arg3 a4 a5 a6 a7 /tmp/test.gz

Everything is working fine (my code is executed, file decopressed and so on).
I have my script in /opt/splunk/bin/script

code 2 suggest splunk can not find the script ? Why ?

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...