Alerting

Is the alert script capability for alert actions restricted to the admin user or is there a setting I can change?

pduflot
Path Finder

Hello,

I have a python script as an alert action.
I could not make it work until I changed the owner of the alert to admin. Even when the owner had the admin role, the script was not called.
In the scheduler.log, I see alert_actions="" when the user is not the admin user.
While I see, alert_actions="script" when the user is the admin user.

Is this alert script capability restricted to the admin user or are there any other settings I can change?

Thanks,

0 Karma
1 Solution

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

View solution in original post

0 Karma

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...