Send Alerts or Traps to MOM

[nikhilmehra79]

Hi Guys,

QQ : is there a way we can send alerts or traps from Splunk to another system which happen to be MOM (manager of Manage), we want to consolidate all alerts at one place, and logically it makes sense to send Log Analyzed Alerts and Operational Integglicence alerts from Splunk to MOM ...please suggest...

[nikhilmehra79]

oh you mean change the credentials of splunkd to run under my service account from local account.

[nikhilmehra79]

so when i manually run the bat file - it creates log output file and write to it , but script can't.

How do we run splunkd process?

[linu1988]

In the earlier case i could see the bat file being called. So if you are able to run the file and its creating directory,could you try to run the splunkd process with you credential in windows service?

[nikhilmehra79]

i tried creating dir both in Splunk_home/bin/scripts and MyApp/etc/apps/NOCApp/bin/scripts from cmd ...i can create directory ...so not sure if it is a permission issue

[nikhilmehra79]

i do not see echo.bat in /bin/script dir.

[linu1988]

As you are using splunk v5 , there will be already a echo.bat file present in bin/script directory. Please check that one if it is creating the file echo_output.txt, if not check for permission on the directory to splunk.

Create simple bat file like >md MyDir. This will verify

[nikhilmehra79]

The above two posts are from last line on the Python.log, it seems it is running script but when you look at below script D:Splunkv5etcappsNOCAppbinscriptsSendTrapScript.bat
it doesnt get called
@echo off
date /T >> "test_output.txt"
time /t >> "test_output.txt"
echo ---------------------------------------- >> "test_output.txt"

[nikhilmehra79]

"http://DEUI1:8000/app/search/flashtimeline?q=%7Cloadjob%20rt_scheduler__admin__NOCApp__RMD5788d8971d..." "" "D:\Splunkv5\var\run\splunk\dispatch\rt_scheduler_adminNOCApp_RMD5788d8971d06dff15_at_1388531039_42.276\per_result_alert\tmp_0.csv.gz" "

[nikhilmehra79]

runshellscript: C:\Windows\system32\cmd.exe /c " "D:\Splunkv5\etc\apps\NOCApp\bin\scripts\SendTrapScript.bat" "1" "(source="D:\Sp\VNotifier\VNOTIFIER.out" AND SEVERITY=Critical) index="main"" "(source="D:\Sp\VNotifier\VNOTIFIER.out" AND SEVERITY=Critical) index="main"" "All_Critical_Alerts_Triggering-Script" "Saved Search [All_Critical_Alerts_Triggering-Script] always(1)"

[nikhilmehra79]

i actually tried with bat only ....( i can worry about perl later), but seems like script is getting called (or alteast tried) but doesnt seem to execute. Look at logs entry from my python.log

(pasting in next section char limit)

[linu1988]

For other scripts you need to have the compilers installed and they should be called by a bat file
e.g pyhton test.py etc. Check for the logs whether they are called properly.

[linu1988]

If you are on windows machine, perl compiler may not be present to run the script. Bat file should run fine. If you go to Splunk\var\log\splunk\python.log you should be able to find the file is properly called or not. For now keep the bat file under bin/scripts folder. There may be permission issue creating the file, check that. Sample is here

_http://docs.splunk.com/Documentation/Splunk/6.0.1/Alert/Configuringscriptedalerts

[nikhilmehra79]

Sounds good.

Though i started with Command/Batch/Script call to get a handle..

I built a simple batch and perl script ...called it from saved search (script is very simple right now, not even parsing and argument but rather just echoing out some text to a log file..)

to my surprise it is not calling script(pl) or bat file

i tried "File name of bat/perl script to run" to have Script name MyPerl.pl , MyPerl, MyBatch.bat, MyBatch - none of these are called as i am not echoing out anything to a log file...what can i be missing any idea/clue?

[nikhilmehra79]

Though i found this:

Found this :
http://docs.splunk.com/Documentation/Splunk/5.0/Alert/Configuringscriptedalerts

Do we have anything other than these arguments, how about arguments which are not quoted here?

[nikhilmehra79]

does the script accept inline arguments? If yes any refernce how...i think that is best option i see...Thanks for answer

[linu1988]

if the system accepts email , you can have a configured mail alert or you can trigger a script which sends data to specific port/ whatever you want. it's in your hands what you want to do. But splunk doesn't provide anything automatically or have any ready made functionality as far as i know.