Getting Data In

How to execute custom script on Universal Fowarder when Event Trigger Alert raised

Observer

How to execute custom script on Universal Fowarder when Event Trigger Alert raised?
I am monitoring my linux audit logs, upon receiving event from the remote client (UF), I want to trigger an event alert which will execute a custom script on the remote client.
Reviewed the following but I'm not sure whether this will execute the script on the UF or on the SH which detects the event.

http://dev.splunk.com/view/dev-guide/SP-CAAAE68

Newbie

0 Karma

SplunkTrust
SplunkTrust

Alert action scripts run on the search head. Did you see this text in the link you cited?

"Keep in mind, however, that running a
script when an alert is triggered has
been deprecated in Splunk Enterprise
6.3, and therefore is not recommended for use."

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Observer

So there isn't a way to use alert action to trigger execution of script on the Universal Forwarder?

0 Karma

SplunkTrust
SplunkTrust

I'm not aware of a way.

---
If this reply helps you, an upvote would be appreciated.
0 Karma