How can i run a Python script whenever the alert is generated taking the Hostname from the Alert and would like to use that inside the script ?

[tarunmalhotra79]

I am looking forward to create a Python script which should run whenever there we get Alerted.

Also, My alert would be showing a Hostname and I would like to use that Hostname information inside my Python script.

Apologies in advance, I am doing it for the first time so it would be really helpful if you can help me like how can this be possible ?

Thanks in advance

[arjunpkishore5]

Hi @tarunmalhotra792

Couple of ways to do this,

1. Code your script as an alert action - This is available here - https://www.youtube.com/watch?v=UqJAc7rpFmQ
2. Host your script in an external system which can be called through a webhook. Call this external webhook through the Webhook alert action - https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Webhooks

As an example, I have automations defined on a Jenkins server where a pipeline is triggered through a POST request to the server.

Hope this helps.

Cheers.

[broberg]

Write your alert data to a summary index.
Make the python script query the summary index and if there is new data there do your magic like taking out the hostname (that is alerted into the summary index)

This require your script to query that index all the time, but i do not think there is any better options.

[tarunmalhotra79]

Thanks for the information.

Could you please guide me through that process, How can i search results from Summary Index using my python script.

Ultimately, I have use that host name collected from that SI and then using that host name info. my python script will connect with SSH and perform some action.

[broberg]

You do a REST api search towards the index and collects the data that way.