Splunk Addon builder alert action to store results in to a custom index

[nareshkumarg]

Hi Everyone,

I am working on an addon to collect event result based for an an alert and send it to an API endpoint. Once the response is success the endpoint returns a success message in a json format and I Want to store it in a custom index and sourcetype.

I tired using below code but the data is written to Main index instead of my custom index. Is there way to write the event in to custom index for an alert action build via Splunk Addon builder.

helper.addevent("hello", sourcetype="customsource")
helper.addevent("world", sourcetype="customsource")
helper.writeevents(index="mycustomindex", host="localhost", source="localhost")

Regards,

Naresh

[nareshkumarg · Accepted solution]

Looks like the only way is to use the HEC method to make an API call back to store the data into an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature to OOB on its future version.

Regards,

Naresh

[nareshkumarg]

Could someone help me with this? I am stuck on how to save the API call results back to Splunk index for an alert action call.

Regards,

Naresh