Monitoring Splunk

Splunk alerts logs: Where to see the logs generated by the Python Scrypt app?

jdepedro
Engager

Hi all, good morning,

my first question on the community, as I have just started learning.  So please be gentle if what I am asking is something obvious. 😉

I have configured an alert that executes two actions: send an email, and execute an customized app. 

I'd like to know how to search the logs generated by the execution of the actions configured on this alert, specifically the logs generated by the app. 

Could anyone please let me know where to see the logs generated by the app (python scrypt)?

Thanks in advance. Kind regards, 

Juan

Labels (1)
Tags (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jdepedro,

at first I hint to add a third action: "Add to triggered alerts", so you can see your alert in the Splunk jobs.

Then, you can take the logs of the triggered alerts in _internal, as all Splunk logs.

About the python script, it depends on the script itself, but I'm not an expert of sctipting.

Ciao.

Giuseppe

View solution in original post

jdepedro
Engager

thanks a lot, gcusello. I have found out some of the information that I wanted.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jdepedro,

at first I hint to add a third action: "Add to triggered alerts", so you can see your alert in the Splunk jobs.

Then, you can take the logs of the triggered alerts in _internal, as all Splunk logs.

About the python script, it depends on the script itself, but I'm not an expert of sctipting.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...