Alerting

Why is the Script in custom alert action app is not working properly?

sudhir7
Explorer

I have created a custom alert action app to restart Splunk.
Here is restart_splunk.bat file, which I used in custom alert action app.

:start

cd "C:\Program Files\Splunk\bin\"

break>"C:\Program Files\Splunk\etc\apps\restart_splunk\bin\data.dat"

splunk search "| rest /services/search/jobs | search dispatchState=Running OR dispatchState=Finalizing OR dispatchState=Backgrounded | table author" -auth admin:changeme >> "C:\Program Files\Splunk\etc\apps\restart_splunk\bin\data.dat"

for /f %%i in ('find /v /c "" ^<"C:\Program Files\Splunk\etc\apps\restart_splunk\bin\data.dat"') do set myint=%%i

IF %myint%==3 (
    cd "C:\Program Files\Splunk\bin\"
    splunk restart
    )

IF NOT %myint%==3 (    
    timeout 60
    goto start
    )

When I run this script manually, it works fine.
But when I schedule a custom alert, it just stops Splunk instead of restarting.
I tried this using "splunk stop" and "splunk start" instead of "splunk restart", but the result is same.

Has anyone else faced a similar situation ?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@sudhir7 ,The user who is running the scheduled script has same permission as you run manually? Also check ownership of splunk files

Happy Splunking!
0 Karma

sudhir7
Explorer

Hi @renjith.nair , Thanks for your reply.
For testing purpose, I have created an ec2 instance, which has only one user i.e. Administrator.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...