Alerting

How to execute a mysql command over ssh script based on alert

Cuyose
Builder

Can't find an easy way to do this. I want to create a .py script that gets kicked off when an alert triggers. I can run a single command from the splunk machine cli, however it prompts me for a password.

Basically when I see an event I want to write the results of a sql query to a file. Since mysql is not installed on the splunk machine I need to ssh to the mysql machine to run the statement.

How have people been solving this?

Tags (4)

Cuyose
Builder

I got around this by just installing mysql client on the splunk machine and creating a simple py script
import os
os.system("mysql -u {user} -p{psw} -h {hostIP} -e "show full processlist;" -B >> /splunk/showprocesslist.csv")
This appends to a csv file

yannK
Splunk Employee
Splunk Employee

If you found the solution, you should reply as an answer and accept your answer.
It will help the other users, and mark the question as resolved.

martin_mueller
SplunkTrust
SplunkTrust

To avoid getting prompted for an SSH password you can store your SSH key on the other machine and log in using that.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...