Alerting

Splunk Addon builder alert action to store results in to a custom index

nareshkumarg
Path Finder

Hi Everyone,

I am working on an addon to collect event result based for an an alert and send it to an API endpoint. Once the response is success the endpoint returns a success message in a json format and I Want to store it in a custom index and sourcetype.

I tired using below code but the data is written to Main index instead of my custom index. Is there way to write the event in to custom index for an alert action build via Splunk Addon builder.

helper.addevent("hello", sourcetype="customsource")
helper.addevent("world", sourcetype="customsource")
helper.writeevents(index="mycustomindex", host="localhost", source="localhost")

Regards,

Naresh

Labels (2)
0 Karma
1 Solution

nareshkumarg
Path Finder

Looks like the only way is to use the HEC method to make an API call back to store the data into an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature to OOB on its future version.

Regards,

Naresh

View solution in original post

0 Karma

nareshkumarg
Path Finder

Looks like the only way is to use the HEC method to make an API call back to store the data into an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature to OOB on its future version.

Regards,

Naresh

0 Karma

nareshkumarg
Path Finder

Could someone help me with this? I am stuck on how to save the API call results back to Splunk index for an alert action call.

Regards,

Naresh

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...