All Apps and Add-ons

How can i run a Python script whenever the alert is generated taking the Hostname from the Alert and would like to use that inside the script ?

tarunmalhotra79
Engager

I am looking forward to create a Python script which should run whenever there we get Alerted.

Also, My alert would be showing a Hostname and I would like to use that Hostname information inside my Python script.

Apologies in advance, I am doing it for the first time so it would be really helpful if you can help me like how can this be possible ?

Thanks in advance

0 Karma

arjunpkishore5
Motivator

Hi @tarunmalhotra792

Couple of ways to do this,

  1. Code your script as an alert action - This is available here - https://www.youtube.com/watch?v=UqJAc7rpFmQ
  2. Host your script in an external system which can be called through a webhook. Call this external webhook through the Webhook alert action - https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Webhooks

As an example, I have automations defined on a Jenkins server where a pipeline is triggered through a POST request to the server.

Hope this helps.

Cheers.

0 Karma

broberg
Communicator

Write your alert data to a summary index.
Make the python script query the summary index and if there is new data there do your magic like taking out the hostname (that is alerted into the summary index)

This require your script to query that index all the time, but i do not think there is any better options.

0 Karma

tarunmalhotra79
Engager

Thanks for the information.

Could you please guide me through that process, How can i search results from Summary Index using my python script.

Ultimately, I have use that host name collected from that SI and then using that host name info. my python script will connect with SSH and perform some action.

0 Karma

broberg
Communicator

You do a REST api search towards the index and collects the data that way.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...