Getting Data In

How to execute custom script on Universal Fowarder when Event Trigger Alert raised

amit20190
Observer

How to execute custom script on Universal Fowarder when Event Trigger Alert raised?
I am monitoring my linux audit logs, upon receiving event from the remote client (UF), I want to trigger an event alert which will execute a custom script on the remote client.
Reviewed the following but I'm not sure whether this will execute the script on the UF or on the SH which detects the event.

http://dev.splunk.com/view/dev-guide/SP-CAAAE68

Newbie

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Alert action scripts run on the search head. Did you see this text in the link you cited?

"Keep in mind, however, that running a
script when an alert is triggered has
been deprecated in Splunk Enterprise
6.3, and therefore is not recommended for use."

---
If this reply helps you, Karma would be appreciated.
0 Karma

amit20190
Observer

So there isn't a way to use alert action to trigger execution of script on the Universal Forwarder?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a way.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...