I have created a Splunk alert that will be triggered when a Windows-based service is down (ie. Print Spooler). For example, it will check a list of servers real-time and display the server/host if the Print Spooler service is down. My question is how do I automatically restart that Windows > Print Spooler service using the "Run a script" action from the alert? Do I need to create a batch script and put in the "$SPLUNK_HOME/bin/scripts" folder? Our Splunk search heads/indexer are running on Linux.
Can someone help with an example on what the script should look like? Do I just create a simple batch script with the following line...
sc.exe start "Print Spooler"
Also, do I need to pass the $result.host$ to the script so that it knows which server/host to run the script?