Alerting

Splunk Alert Script on Windows

gdavid
Path Finder

I am trying to find info on how to write a custom alert script in python on windows.

Initially i thought i would write a custom email script to modify some fields and subject lines etc to create tickets via email.
Based on this script, i could later create a ticket directly with my ticketing platform.

I can't seem to find any info on the scripts and modules available to splunk internally (ex: email). I see the SDKs for various languages but this seems to be from outside splunk. What if i want to leverage a script inside splunk and just use the same modules? i know i could rip apart the current sendemail.py, it just seems like this might be documented already somewhere.

Also there is so no clear indication for me on how to get the results of a search alert into my script.
There is an article here on how to do this, but it seems not to be for windows.
http://www.seanelavelle.com/2012/04/11/scripting-splunk-alerts-with-python/

thanks

gd

0 Karma

MartinMcNutt
Communicator

I am currently trying to do the same but with powershell. I want to execute a script to update a users attribute if value/Alert is triggered.

I found this document which I have been using to start working on it.

ConfiguringScriptedAlerts

gdavid
Path Finder

right i saw that page, but it still leaves me with a ton of questions. so in order to use python, they have this block:

to use Python to interpret the script file:
'---- myscript.py -----
'#!/path/to/python
'.....
'.....

does this mean that i need to install my own version of python? or is there a way to point it to the version installed with splunk?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...