Getting Data In

How to execute custom script on Universal Fowarder when Event Trigger Alert raised

amit20190
Observer

How to execute custom script on Universal Fowarder when Event Trigger Alert raised?
I am monitoring my linux audit logs, upon receiving event from the remote client (UF), I want to trigger an event alert which will execute a custom script on the remote client.
Reviewed the following but I'm not sure whether this will execute the script on the UF or on the SH which detects the event.

http://dev.splunk.com/view/dev-guide/SP-CAAAE68

Newbie

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Alert action scripts run on the search head. Did you see this text in the link you cited?

"Keep in mind, however, that running a
script when an alert is triggered has
been deprecated in Splunk Enterprise
6.3, and therefore is not recommended for use."

---
If this reply helps you, Karma would be appreciated.
0 Karma

amit20190
Observer

So there isn't a way to use alert action to trigger execution of script on the Universal Forwarder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...