Getting Data In

How To Restart A Windows-based Service From A Triggered Alert - Run A Script

New Member


I have created a Splunk alert that will be triggered when a Windows-based service is down (ie. Print Spooler). For example, it will check a list of servers real-time and display the server/host if the Print Spooler service is down. My question is how do I automatically restart that Windows > Print Spooler service using the "Run a script" action from the alert? Do I need to create a batch script and put in the "$SPLUNK_HOME/bin/scripts" folder? Our Splunk search heads/indexer are running on Linux.

Can someone help with an example on what the script should look like? Do I just create a simple batch script with the following line...

sc.exe start "Print Spooler"

Also, do I need to pass the $$ to the script so that it knows which server/host to run the script?

Thank you for your advice.

0 Karma

New Member

I'd like to know the same thing. I've been trying to do something very similar for about 6 months and read every document splunk has and nothing seems to work.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.