Alerting

How to create a python script that generates an alert if the number of events returned from a search is 0?

Communicator

Hi,

I'm new to splunk sdk so, forgive me if my question is obvious.
I'm trying to create a python script that runs a search job every minutes and give an alert if the number of events is 0.

I'm starting with the connection:

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

//Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

myquery = "*"
mysearchname = "hello"

//Check if this already exist
//mysavedsearch = service.saved_searches.create(mysearchname, myquery)
mysavedsearch = service.saved_searches["hello"]

kwargs = {"description": "This is a test search",
        "is_scheduled": True,
        "cron_schedule": "*/5 * * * *  ",}

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]

Ok but how do I set the parameters of the alert?
Could someone confirm if this is correct?

Thank you in advance

0 Karma
1 Solution

Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]

View solution in original post

Communicator

How are you calling this script? Is it through scripted input? I have similar requirement. Please help.

0 Karma

Communicator

In the end, this is my code and work

import splunklib.client as client


HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Variables
myquery = "index=main | transaction dc(host) by host"
mysearchname = "h1"
a=0

# Create the search
savedsearches = service.saved_searches
for savedsearch in savedsearches:
    if (savedsearch.name=="h1"): a=1
if a==0: mysavedsearch = service.saved_searches.create(mysearchname, myquery)

# Edit the search
mysavedsearch = service.saved_searches["h1"]
kwargs = {"description": "This is a search",
        "is_scheduled": True,
        "cron_schedule": "*/1 * * * *  ",
    "alert.track":1,
    "alert_comparator":"greater than",
    "alert_type":"number of events",
    "alert_threshold":0,
    "alert.severity":5,
        }

mysavedsearch.update(**kwargs).refresh()

print "Description:         ", mysavedsearch["description"]
print "Is scheduled:        ", mysavedsearch["is_scheduled"]
print "Cron schedule:       ", mysavedsearch["cron_schedule"]
print "Next scheduled time: ", mysavedsearch["next_scheduled_time"]
print "Alert track      ", mysavedsearch["alert.track"]

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!