Alerting

How do I get the alert to use host as a token?

andrew_burnett
Path Finder

I want to create a custom alert action that when the alert fires, it takes the host from the search results, and uses it is a token to remotely restart a host. I can get the REST URL right, but how do I get the alert to use host as a token?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Fields from the first row of results are available as tokens to be passed to the custom action - $result.field$

0 Karma

andrew_burnett
Path Finder

Can you show me how that would sort of look?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with a search which finds the hosts that you want to alert on.

0 Karma

andrew_burnett
Path Finder

So what I have is this so far, in alert actions.conf. Already have the search, dealing with the alert portion.

[restart_splunk]

is_custom = 1

filename = restart.sh

 

In /opt/bin/scripts, I have this script

curl -k -u admin:test1234 https://$result.host$:8089/services/server/control/restart -X POST

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The script doesn't have access to the tokens, they would need to be passed as arguments to your script.

Advanced options for working with custom alert actions - Splunk Documentation

0 Karma

andrew_burnett
Path Finder

Yeah I keep getting this 

andrew_burnett_0-1652462733369.png

 

0 Karma

andrew_burnett
Path Finder

It isn't finding the script, will keep trying

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...