Alerting

Splunk Addon builder alert action to store results in to a custom index

nareshkumarg
Path Finder

Hi Everyone,

I am working on an addon to collect event result based for an an alert and send it to an API endpoint. Once the response is success the endpoint returns a success message in a json format and I Want to store it in a custom index and sourcetype.

I tired using below code but the data is written to Main index instead of my custom index. Is there way to write the event in to custom index for an alert action build via Splunk Addon builder.

helper.addevent("hello", sourcetype="customsource")
helper.addevent("world", sourcetype="customsource")
helper.writeevents(index="mycustomindex", host="localhost", source="localhost")

Regards,

Naresh

Labels (2)
0 Karma
1 Solution

nareshkumarg
Path Finder

Looks like the only way is to use the HEC method to make an API call back to store the data into an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature to OOB on its future version.

Regards,

Naresh

View solution in original post

0 Karma

nareshkumarg
Path Finder

Looks like the only way is to use the HEC method to make an API call back to store the data into an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature to OOB on its future version.

Regards,

Naresh

0 Karma

nareshkumarg
Path Finder

Could someone help me with this? I am stuck on how to save the API call results back to Splunk index for an alert action call.

Regards,

Naresh

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...