Alerting

Custom Script to capture splunk alert message

saurabhray25
Engager

Hi,

I have created an alert for an event in real-time. For example, send me an alert if a user is not able to log in 3 times.

On the above event, I have created an alert action. Here I want to trigger a custom script.

The purpose of this Python script will be to capture the error message and send it to a different application using Key Based authentication.

However, I am not able to fetch the error message.

Using sys.argv gives me the parameters but the error message is encoded. Can anyone assist me here, how can I extract the error message from the event triggering the alert?

Labels (3)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Search results will be part of the "Path to file containing the search results" (arg 8 ) and you might need to open and read the content of the file in your custom script.

Reference  : https://docs.splunk.com/Documentation/Splunk/8.0.6/Alert/Configuringscriptedalerts

Please note that the run a script alert action is deprecated officially. Please refer to the below documentation to convert to Custom alert action framework

https://docs.splunk.com/Documentation/Splunk/8.0.6/AdvancedDev/CustomAlertConvertScripted

 

 

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...