Alerting

How to use Splunkweb alert to run a script on the forwarder to restart a service?

max_ruas
Explorer

Hi I have a service that reports to Splunk and some times fell over, is there any chance I can automate this by telling Splunk to run a scripted input on the forwarder level to restart a service, log it and feed the event to Splunk?
Thank you for any answers
Or is there any add on that would do that for Linux like HK Systems Management

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

This is probably not the best approach since its a temporary fix. But if you want to proceed then you should do something like this

Put a script on your SH which will SSH to your forwarder then do a Splunk restart. Have an alert trigger this script when your service falls over

View solution in original post

0 Karma

max_ruas
Explorer

I've found a solution on the forwarder app it self. on linux is under
cat /opt/splunkforwarder/bin/scripts/readme.txt
Scripts placed in this directory can be called by Alerts for execution

if you define your scheduled search as an alert, you can configure a script to be run whenever the alert is triggered. For security reasons, the scripts need to be placed in a specific folder like the above.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Setupalertactions#Run_a_script_for_an_alert_...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This is probably not the best approach since its a temporary fix. But if you want to proceed then you should do something like this

Put a script on your SH which will SSH to your forwarder then do a Splunk restart. Have an alert trigger this script when your service falls over

0 Karma

max_ruas
Explorer

are you suggesting that in order to run a script on the forwarder I need to do a splunkforwarder restart? can you please clarify your answer?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

No.. What I suggested was creating a script on your SH. Then have that script SSH to your forwarder and restart the service

0 Karma

max_ruas
Explorer

Thanks for the answer I think is valid although Is not what I am looking for as its much more complex that it needs to be, I am looking for some thing like this.. I haven't got around to test yet but I'm hoping it works.
https://answers.splunk.com/answering/232172/view.html

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...