How do you run a script from an alert?

[robertlynch2020]

Hi,
I am trying to run a basic script from an alert in /apps/splunk/bin/scripts/TEST_SCRIPT.sh

#!/bin/sh
DATE=`date '+%Y-%m-%d %H:%M:%S'`
echo $DATE  >> Date_test.log

I am getting the following output, but the file Date_test.log is not getting bigger. When i run it manually i get output.

Any ideas? I am in Splunk 7.0.3

2018-12-12 16:44:02,093 +0100 INFO  runshellscript:222 - runshellscript: ['/bin/sh', '/hp737srv2/apps/splunk/bin/scripts/TEST_SCRIPT.sh', '6', '| tstats count where index="mlc_live"  sourcetype="TPS" by _indextime host \n\t\t  | stats sum(count) as No_Of_TPS_lines max(_indextime) as TIME by host  \n\t\t  | eval TIME=strftime(TIME,"%Y-%m-%d %H:%M:%S") \n\t\t  | sort - host \n\t\t  | table host No_Of_TPS_lines TIME', '| tstats count where index="mlc_live"  sourcetype="TPS" by _indextime host \n\t\t  | stats sum(count) as No_Of_TPS_lines max(_indextime) as TIME by host  \n\t\t  | eval TIME=strftime(TIME,"%Y-%m-%d %H:%M:%S") \n\t\t  | sort - host \n\t\t  | table host No_Of_TPS_lines TIME', 'SCRIPT_TEST', 'Saved Search [SCRIPT_TEST] number of events(6)', 'http://dell425srv:8000/app/murex_mlc/@go?sid=scheduler__admin_bXVyZXhfbWxj__RMD5a63ba5c7fea78f6c_at_1544629440_52364', '', '/hp737srv2/apps/splunk/var/run/splunk/dispatch/scheduler__admin_bXVyZXhfbWxj__RMD5a63ba5c7fea78f6c_at_1544629440_52364/results.csv.gz']

[whrg · Accepted solution]

Hello @robertlynch2020,

I see you are using a relative path (echo ... >> Date_test.log). Try using an absolute path instead.

See Working directories for scripts:

Specify an absolute path whenever a path is needed. If you use relative paths, it is important to remember that they are rooted in the Search and Reporting app's bin folder.

[robertlynch2020]

cheers that worked perfect 🙂