Alerting

How do I get the alert to use host as a token?

andrew_burnett
Path Finder

I want to create a custom alert action that when the alert fires, it takes the host from the search results, and uses it is a token to remotely restart a host. I can get the REST URL right, but how do I get the alert to use host as a token?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Fields from the first row of results are available as tokens to be passed to the custom action - $result.field$

0 Karma

andrew_burnett
Path Finder

Can you show me how that would sort of look?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with a search which finds the hosts that you want to alert on.

0 Karma

andrew_burnett
Path Finder

So what I have is this so far, in alert actions.conf. Already have the search, dealing with the alert portion.

[restart_splunk]

is_custom = 1

filename = restart.sh

 

In /opt/bin/scripts, I have this script

curl -k -u admin:test1234 https://$result.host$:8089/services/server/control/restart -X POST

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The script doesn't have access to the tokens, they would need to be passed as arguments to your script.

Advanced options for working with custom alert actions - Splunk Documentation

0 Karma

andrew_burnett
Path Finder

Yeah I keep getting this 

andrew_burnett_0-1652462733369.png

 

0 Karma

andrew_burnett
Path Finder

It isn't finding the script, will keep trying

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...