Alerting

How do I get the alert to use host as a token?

andrew_burnett
Path Finder

I want to create a custom alert action that when the alert fires, it takes the host from the search results, and uses it is a token to remotely restart a host. I can get the REST URL right, but how do I get the alert to use host as a token?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Fields from the first row of results are available as tokens to be passed to the custom action - $result.field$

0 Karma

andrew_burnett
Path Finder

Can you show me how that would sort of look?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with a search which finds the hosts that you want to alert on.

0 Karma

andrew_burnett
Path Finder

So what I have is this so far, in alert actions.conf. Already have the search, dealing with the alert portion.

[restart_splunk]

is_custom = 1

filename = restart.sh

 

In /opt/bin/scripts, I have this script

curl -k -u admin:test1234 https://$result.host$:8089/services/server/control/restart -X POST

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The script doesn't have access to the tokens, they would need to be passed as arguments to your script.

Advanced options for working with custom alert actions - Splunk Documentation

0 Karma

andrew_burnett
Path Finder

Yeah I keep getting this 

andrew_burnett_0-1652462733369.png

 

0 Karma

andrew_burnett
Path Finder

It isn't finding the script, will keep trying

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...