Alerting

Splunk Alert Script on Windows

gdavid
Path Finder

I am trying to find info on how to write a custom alert script in python on windows.

Initially i thought i would write a custom email script to modify some fields and subject lines etc to create tickets via email.
Based on this script, i could later create a ticket directly with my ticketing platform.

I can't seem to find any info on the scripts and modules available to splunk internally (ex: email). I see the SDKs for various languages but this seems to be from outside splunk. What if i want to leverage a script inside splunk and just use the same modules? i know i could rip apart the current sendemail.py, it just seems like this might be documented already somewhere.

Also there is so no clear indication for me on how to get the results of a search alert into my script.
There is an article here on how to do this, but it seems not to be for windows.
http://www.seanelavelle.com/2012/04/11/scripting-splunk-alerts-with-python/

thanks

gd

0 Karma

MartinMcNutt
Communicator

I am currently trying to do the same but with powershell. I want to execute a script to update a users attribute if value/Alert is triggered.

I found this document which I have been using to start working on it.

ConfiguringScriptedAlerts

gdavid
Path Finder

right i saw that page, but it still leaves me with a ton of questions. so in order to use python, they have this block:

to use Python to interpret the script file:
'---- myscript.py -----
'#!/path/to/python
'.....
'.....

does this mean that i need to install my own version of python? or is there a way to point it to the version installed with splunk?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...