Can I give commands to the agent?

[nolja]

hi

index=idx_myindex source="/var/log/mylog.log" host="myhost-*" "memoryError"

I know that if I give the conditions above,
I can search for the log that caused the memoryError. As in the example above,
when a log occurs in myhost-*, I would like to send a command to the host where
the log occurred and execute a specific command on the agent.

Is there a way?

[richgalloway · Accepted solution]

By default, the Splunk Universal Forwarder ("agent") cannot execute arbitrary commands (what a security hole *that* would be!).  In addition, it does not monitor a port so there is no mechanism for sending commands.

With some effort, you may be able to add a script to the appropriate Deployment Server app that the agent would then download and execute.  It's also possible Splunk SOAR might help.