Alerting

Scripted Alert to third party event managemet

bizza
Path Finder

Hi,
we are setting up some alerts based on a vendor script to automatically populate an Event Management Console.
The problem is that we need to extract some informations (=fileds) from Splunk raw data included in the alert to pass it as a parameter to the script itself, so we will be able to pupulate correctly the Event management console.

Example syntax:

custom_bin.sh -n @event.management.console:port -b host_extracted_from_splunk_data -u user_extracted_from_splunk_data

where:

custom_bin.sh is our third party script

-n @event.management.console:port is the event management console fqdn:port

-b host_extracted_from_splunk_data is the host field indexed by splunk present in the specific record we need to extract to

-u user_extracted_from_splunk_data is the user filed extracted ... like the host field

Any hint on how we can achieve it?

Regards

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The eighth parameter passed to the alert script is a path to the search results. You can examine those to extract whatever info you need. http://wiki.splunk.com/Community:Use_Splunk_alerts_with_scripts_to_create_a_ticket_in_your_ticketing...

View solution in original post

rcorbisier_splu
Splunk Employee
Splunk Employee

The Splunk Developer’s Guide and the accompanying Splunk Reference App might be helpful in answering your question. The book is available in both paperback and Mobi from Amazon.

alt text
It was designed by a Splunk dev team to help you learn how to build, test, and deploy apps - The reference app (named PAS) showcases proven practices using the Splunk Developer Platform and includes code that you can download, reuse and even contribute to, code walkthroughs as well as the associated unit and acceptance tests.

The featured example demonstrates how to monitor various document repositories (current and future). Managers and auditors can use the app to see who has viewed, modified, deleted, or downloaded documents or other artifacts from various sources, detect suspicious behaviors, and analyze trends.

Currently an updated version is under development that will expand the functionality, so even if it’s not relevant now you might want to keep checking to see what’s been added.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The eighth parameter passed to the alert script is a path to the search results. You can examine those to extract whatever info you need. http://wiki.splunk.com/Community:Use_Splunk_alerts_with_scripts_to_create_a_ticket_in_your_ticketing...

bizza
Path Finder

thanks martin, i solved just parsing the csv with a perl script.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The path points at a gzipped CSV file, you can pick whatever field you need from that.

0 Karma

rsiekermann_spl
Splunk Employee
Splunk Employee

Hi Martin,

do you have an example of the script you have been using here?

Regards

0 Karma

bizza
Path Finder

Hi Martin, thank for your answer.
I need to extract from results some fields and use they as a parameter for the third party script.
Something like the host, the username for example.
Do you know if it's possible?

regards

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...