Getting Data In

Run a Linux shell script with Alert Action in the standard Search app.

konpa01
New Member

I am running version 8.x. I want to add the capability to run a custom Linux bash script as Alert Action with the OOTB search app. I did the following:

1 - create a file called alert_actions.conf in the /opt/splunk/etc/apps/search/default directory and have the following content.
[sendsnmptrap]
is_custom = 1
label = Send SNMP Traps
description = Custom action to send search result as SNMP traps
ttl = 120
disabled = 0

----how can I call the script?

2 - I create the script in as /opt/splunk/etc/apps/search/bin/sendsnmptrap.sh with the very basic command & parameter

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First off, DO NOT edit in etc/apps/search/default, it will get overwritten on update of splunk, instead use local: https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfiledirectories#About_the_defa...

That being said, you can call scripts using the Run a script alert action: https://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/Runscriptaction or by properly implementing a custom alert using the Modular Alert framework: https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/ModAlertsIntro

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...