Alerting

How to execute a mysql command over ssh script based on alert

Cuyose
Builder

Can't find an easy way to do this. I want to create a .py script that gets kicked off when an alert triggers. I can run a single command from the splunk machine cli, however it prompts me for a password.

Basically when I see an event I want to write the results of a sql query to a file. Since mysql is not installed on the splunk machine I need to ssh to the mysql machine to run the statement.

How have people been solving this?

Tags (4)

Cuyose
Builder

I got around this by just installing mysql client on the splunk machine and creating a simple py script
import os
os.system("mysql -u {user} -p{psw} -h {hostIP} -e "show full processlist;" -B >> /splunk/showprocesslist.csv")
This appends to a csv file

yannK
Splunk Employee
Splunk Employee

If you found the solution, you should reply as an answer and accept your answer.
It will help the other users, and mark the question as resolved.

martin_mueller
SplunkTrust
SplunkTrust

To avoid getting prompted for an SSH password you can store your SSH key on the other machine and log in using that.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...