How to run a script with a alert action?
Example I want to disable a Splunk App if the daily license usage is more than 80%, but when I try to run script on that alert it shows that message "
The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead.
"
Please guide what is the proper way to do it.
Hi,
"Run a script" alert action is deprecated, you need to move to new framework called "Custom Alert Action". Have a look at document https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsIntro and you'll get idea.
I am using below search string:
source=*license_usage.log type="RolloverSummary" earliest=@d | stats sum(b) AS used max(stacksz) AS quota by _time | eval usedGB=round(used/1024/1024/1024,3) | eval quotaGB=round(quota/1024/1024/1024,3) | eval percentage=round(usedGB / quotaGB, 3)*100 | table _time usedGB, quotaGB, percentage, used, quota | where percentage > 80
What is the right way to trigger script with a alert ?