Alerting

Use a Python module in a custom alert action

eden881
Path Finder

I have a custom alert action that I wrote using the manual on the documentation:

https://docs.splunk.com/Documentation/Splunk/7.3.1/AdvancedDev/ModAlertsIntro

I need to import a Python module (boto3) into my action's script.

How can I do that?
Where and how do I install the module?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi eden881,

you can download the module directory or use a python egg of the module, place it in the bin directory of your app (assuming you created your alert action in a seperate app) and use import boto3 at top of your script. That should import the module if all module dependencies are fulfilled.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi eden881,

you can download the module directory or use a python egg of the module, place it in the bin directory of your app (assuming you created your alert action in a seperate app) and use import boto3 at top of your script. That should import the module if all module dependencies are fulfilled.

Hope this helps ...

cheers, MuS

eden881
Path Finder

Thank you! It worked well.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...