Alerting

How to call Node.js instead of python or perl in Alert Script to fire results of the alert to an external system?

tdepuy
Path Finder

Hello,
I am writing an Alert Script to fire results of the Alert to an external system via REST API over HTTPS. Since python doesn't seem to be compiled with HTTPS support, I am looking at other options. It looks like there is a Node.js executable in /opt/splunk/bin which I tested:

boba@splunk:/opt/splunk/bin$
boba@splunk:/opt/splunk/bin$ pwd
/opt/splunk/bin
boba@splunk:/opt/splunk/bin$ ./node --version
v0.8.14
boba@splunk:/opt/splunk/bin$ ./node
> var https = require( 'https' )
undefined
>
undefined
> https
{ Server: { [Function: Server] super_: { [Function: Server] super_: [Object] } },
  createServer: [Function],
  globalAgent:
   { domain: null,
     _events: { free: [Function] },
     _maxListeners: 10,
     options: {},
     requests: {},
     sockets: {},
     maxSockets: 5,
     createConnection: [Function: createConnection] },
  Agent:
   { [Function: Agent]
     super_:
      { [Function: Agent]
        super_: [Function: EventEmitter],
        defaultMaxSockets: 5 } },
  request: [Function],
  get: [Function] }
>

However, when I try to call my "/opt/splunk/bin/scripts/test.js" script:


boba@splunk:/opt/splunk/bin/scripts$ cat test.js

!/opt/splunk/bin/node

"use strict"
var https = require( 'https' );
var fs = require( 'fs' );
var LOGFILE = "my.log"
fs.appendFile( LOGFILE, "Parms: " + process.argv + "\n" )

from the Alert, the splunkd.log prints this:

splunkd.log:10-16-2014 17:28:28.304 -0700 ERROR script - command="runshellscript", Cannot find script at /opt/splunk/bin/scripts/test.js

Despite this:


boba@splunk:/opt/splunk/bin/scripts$ file /opt/splunk/bin/scripts/test.js
/opt/splunk/bin/scripts/test.js: a /opt/splunk/bin/node script, ASCII text executable

0 Karma
1 Solution

tdepuy
Path Finder

Having a python wrapper script seems to work. This hard codes the path, but demonstrates the functionality.

#!/opt/splunk/bin/python

from subprocess import call
import sys

call( ["/opt/splunk/bin/node", "/opt/splunk/bin/scripts/test.js"] + sys.argv )

View solution in original post

0 Karma

jrodman
Splunk Employee
Splunk Employee

Alert script invocation supports #! scripts, so you can use an executable textfile that looks like #!/path/to/node on the first line.

Errrr, this should work anyway. I'll try it.

Yes, this error makes little sense.

In the current code, this is, in etc/apps/search/bin/runshellscript.py:

if not os.path.exists(script):
    results = splunk.Intersplunk.generateErrorResults('Cannot find script at ' +script)

So this message indeed means that path isn't available. Something else must be going on in the environment, or you may be using a version where this code is different.

0 Karma

tdepuy
Path Finder

Having a python wrapper script seems to work. This hard codes the path, but demonstrates the functionality.

#!/opt/splunk/bin/python

from subprocess import call
import sys

call( ["/opt/splunk/bin/node", "/opt/splunk/bin/scripts/test.js"] + sys.argv )
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...