Alerting

Run a shell script in remote linux server based on the value of "Host" field returned for that alert query

Elavarasi02
New Member

Hi,

I've a shell script to restart services. I want to setup an alert condition to run this shell script in a remote node(remote host in which this script should run should be determined based on the value which is being returned in "Host" field value in the Splunk query). 

If I place the shell script in "$SPLUNK_HOME/bin/scripts" , this script runs only on the Splunk server. I want to know how can i make it to run on the remote node based on the host value being returned from Splunk query. Any help would be much appreciated!. Thank you

 

Labels (3)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi

Maybe a better way could be to run those services under systemd on linux servers and give it to handle restarts?

With script on splunk server you must also give access to all other servers from splunk server with Splunk User and then give needed sudo access to that user on all servers where you want start those services (could be huge security risk/issue that way)!

r. Ismo
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...