Getting Data In

Is there a way to launch a script on the Universal Forwarder's App's bin directory from the search head?

daniel333
Builder

Hello,

Is there a way to launch a script on the Universal Forwarder's App's bin directory from the search head?

For example:
Scheduled search index=java *oom* host=mybadjbossserver

Causes:
mybadjbossserver's universal forwarder to call /opt/splunkforwarders/etc/apps/myjobsapps/bin/fixjboss.sh to run

Right now I have scripted inputs that have scripts that check the condition via bash, which isn't good. I suppose I could use wget to make an API call to a search head and act on results, but I feel like I would be running the same script twice (one for the notification and one for the action) and I am not really confident in my ability to produce a good API call.

0 Karma

tom_frotscher
Builder

Hi,

if you define your scheduled search as an alert, you can configure a script to be run whenever the alert is triggered. For security reasons, the scripts need to be placed in a specific folder, which can be similar to the folder you posted:

$SPLUNK_HOME/etc/<AppName>/bin/scripts

Is this a solution to your problem?

You can get further informations here:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Setupalertactions#Run_a_script_for_an_alert_...

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...