Alerting

How to create a python script that generates an alert if the number of events returned from a search is 0?

Federica_92
Communicator

Hi,

I'm new to splunk sdk so, forgive me if my question is obvious.
I'm trying to create a python script that runs a search job every minutes and give an alert if the number of events is 0.

I'm starting with the connection:

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

//Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

myquery = "*"
mysearchname = "hello"

//Check if this already exist
//mysavedsearch = service.saved_searches.create(mysearchname, myquery)
mysavedsearch = service.saved_searches["hello"]

kwargs = {"description": "This is a test search",
        "is_scheduled": True,
        "cron_schedule": "*/5 * * * *  ",}

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]

Ok but how do I set the parameters of the alert?
Could someone confirm if this is correct?

Thank you in advance

0 Karma
1 Solution

Federica_92
Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]

View solution in original post

k_harini
Communicator

How are you calling this script? Is it through scripted input? I have similar requirement. Please help.

0 Karma

Federica_92
Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...