Alerting

Is the alert script capability for alert actions restricted to the admin user or is there a setting I can change?

pduflot
Path Finder

Hello,

I have a python script as an alert action.
I could not make it work until I changed the owner of the alert to admin. Even when the owner had the admin role, the script was not called.
In the scheduler.log, I see alert_actions="" when the user is not the admin user.
While I see, alert_actions="script" when the user is the admin user.

Is this alert script capability restricted to the admin user or are there any other settings I can change?

Thanks,

0 Karma
1 Solution

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

View solution in original post

0 Karma

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...