Alerting

What capability is required to be able to execute a shell script when an alert is fired?

robertlight
Path Finder

I cannot run a shell script as part of my alert. It is clear that I need my user to have a particular splunk capability - when I add the "admin" role, I am able to run my shell script, without "admin" role, I get an error saying it can't find search "runshellscript"

What splunk "capability" is required to run a shell script??

0 Karma
1 Solution

robertlight
Path Finder

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

View solution in original post

robertlight
Path Finder

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

Yasaswy
Contributor

Hi.. I don't think there is a specific capability requirement to allow scripts within alerts. As along as "schedule_search" capability is allowed for the role. The users within that role should be able to setup script for alert actions.
There is very good documentation for setting up alerts here
Some info on troubleshooting here

Hope the info resolves your current issue.

0 Karma

robertlight
Path Finder

I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.

Hence my suspicion that my user is lacking a 'capability'.

0 Karma

Yasaswy
Contributor

Ah.. reasonable suspicion. The list of offered capabilities is not that long .. and nothing seems to jump out pointing to this specific retirement (for me). So if you set any other kind of alert (email for eg).. does it work (without needing admin role)? What are the permissions on the script?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...