Getting Data In

How To Restart A Windows-based Service From A Triggered Alert - Run A Script

New Member


I have created a Splunk alert that will be triggered when a Windows-based service is down (ie. Print Spooler). For example, it will check a list of servers real-time and display the server/host if the Print Spooler service is down. My question is how do I automatically restart that Windows > Print Spooler service using the "Run a script" action from the alert? Do I need to create a batch script and put in the "$SPLUNK_HOME/bin/scripts" folder? Our Splunk search heads/indexer are running on Linux.

Can someone help with an example on what the script should look like? Do I just create a simple batch script with the following line...

sc.exe start "Print Spooler"

Also, do I need to pass the $$ to the script so that it knows which server/host to run the script?

Thank you for your advice.

0 Karma

New Member

I'd like to know the same thing. I've been trying to do something very similar for about 6 months and read every document splunk has and nothing seems to work.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!