Alerting

What capability is required to be able to execute a shell script when an alert is fired?

robertlight
Path Finder

I cannot run a shell script as part of my alert. It is clear that I need my user to have a particular splunk capability - when I add the "admin" role, I am able to run my shell script, without "admin" role, I get an error saying it can't find search "runshellscript"

What splunk "capability" is required to run a shell script??

0 Karma
1 Solution

robertlight
Path Finder

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

View solution in original post

robertlight
Path Finder

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

View solution in original post

Yasaswy
Contributor

Hi.. I don't think there is a specific capability requirement to allow scripts within alerts. As along as "schedule_search" capability is allowed for the role. The users within that role should be able to setup script for alert actions.
There is very good documentation for setting up alerts here
Some info on troubleshooting here

Hope the info resolves your current issue.

0 Karma

robertlight
Path Finder

I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.

Hence my suspicion that my user is lacking a 'capability'.

0 Karma

Yasaswy
Contributor

Ah.. reasonable suspicion. The list of offered capabilities is not that long .. and nothing seems to jump out pointing to this specific retirement (for me). So if you set any other kind of alert (email for eg).. does it work (without needing admin role)? What are the permissions on the script?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!