All Apps and Add-ons

How can i run a Python script whenever the alert is generated taking the Hostname from the Alert and would like to use that inside the script ?

tarunmalhotra79
Engager

I am looking forward to create a Python script which should run whenever there we get Alerted.

Also, My alert would be showing a Hostname and I would like to use that Hostname information inside my Python script.

Apologies in advance, I am doing it for the first time so it would be really helpful if you can help me like how can this be possible ?

Thanks in advance

0 Karma

arjunpkishore5
Motivator

Hi @tarunmalhotra792

Couple of ways to do this,

  1. Code your script as an alert action - This is available here - https://www.youtube.com/watch?v=UqJAc7rpFmQ
  2. Host your script in an external system which can be called through a webhook. Call this external webhook through the Webhook alert action - https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Webhooks

As an example, I have automations defined on a Jenkins server where a pipeline is triggered through a POST request to the server.

Hope this helps.

Cheers.

0 Karma

broberg
Communicator

Write your alert data to a summary index.
Make the python script query the summary index and if there is new data there do your magic like taking out the hostname (that is alerted into the summary index)

This require your script to query that index all the time, but i do not think there is any better options.

0 Karma

tarunmalhotra79
Engager

Thanks for the information.

Could you please guide me through that process, How can i search results from Summary Index using my python script.

Ultimately, I have use that host name collected from that SI and then using that host name info. my python script will connect with SSH and perform some action.

0 Karma

broberg
Communicator

You do a REST api search towards the index and collects the data that way.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...