Developing for Splunk Enterprise

Custom Alert reaction with Python

New Member

Hello,

I want to trigger a a Python script as reaction to an alert. I have added the stanza to alert_actions.conf and restarted Splunk:

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml
filename = myscript.py
alert.execute.cmd = /opt/splunk/etc/apps/bla/bin/myscript.py

In the spunkd log I find the following entry:

02-19-2020 13:25:39.278 +0100 ERROR ModularUtility - Specified filename "..." not found in search path.
...

But the script is definitely there. Kindly help me to find out what I´m missing.

Best Regards Falko

Labels (1)
0 Karma
1 Solution

Influencer

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml

View solution in original post

0 Karma

Influencer

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml

View solution in original post

0 Karma

New Member

Hello,

thank you. This works fine.

Another question I have now is, how can I trigger this alert manually to develop the script? When I run it in the search, the script is not triggered. Is there any way?

Thanks and best regards

Falko

0 Karma

Influencer

Is you script reading any inputs?

If not you can use sendalert command to trigger this alert action.

 <your_search> | sendalert myscript
0 Karma

New Member

Works fine. Thank you!

0 Karma

Influencer

You are welcome. Please accept the answer.

0 Karma