Getting Data In

Splunk .bat script file not getting triggered

sandyasampath
New Member

I'm having a simple alert (for POC, so checking with _internal data) and on alert action there is 'add to triggered alerts' and 'run a script'. I'm able to see the triggered alerts, but the .bat file doesn't seem to run. I'm able to run it manually, but not through the alert action.

I've placed my try.bat under $splunk_home$/bin/scripts folder. While checking for "try.bat" in index=_internal, i get the below event:

2018-01-05 18:22:19,585 +0530 INFO runshellscript:141 - ['C:\Program Files\Splunk\bin\scripts\try.bat', '44', 'index^=internal^ 3mreportErrors', 'index^=_internal^ 3mreportErrors', 'testAlert', 'Saved^ Search^ ^[testAlert^]^ number^ of^ events^(44^)', 'http://CDC2-L-5286WND:8001/app/3m/@go?sid^=scheduleradmin3mtestAlert_at_1515156720_51', '', 'C:\Program Files\Splunk\var\run\splunk\dispatch\scheduleradmin3m_testAlert_at_1515156720_51\results.csv.gz']

try.bat
@echo off
REM Next command inputs the greeting
echo Hello! This a sample batch file.
time /t >> "c:\sandya\output.txt"

I'm using Windows 10, Splunk 7

0 Karma
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...