Getting Data In

Is it possible to have Splunk kick off a script each time it receives a log from a particular log source?

treydismukes
Engager

I have some security devices that are sending logs to my Splunk server. I'd like to have a script on the Splunk server that kicks off each time it receives an alert from my device.

Details:
Security device is sending alerts to my Splunk server.
The script will examine each alert as it comes in.
Based on the contents of the alert it will either ignore it (low priority alert) or forward it to a regional contact for remediation (high priority alert)

Tags (2)
0 Karma

lukejadamec
Super Champion

Yes. This is a very standard use case for Splunk.
Create a search that runs real-time or at an interval that will pull the high priority alerts, save the search as an alert, and set the alert action to Run A Script.

linu1988
Champion

Keep in mind the scripts will be running every instance on the search if realtime not only when the search matches the result. So proper logic should be present to avoid null emails to the destination.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...