Custom Alert reaction with Python

[flk2309]

Hello,

I want to trigger a a Python script as reaction to an alert. I have added the stanza to alert_actions.conf and restarted Splunk:

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml
filename = myscript.py
alert.execute.cmd = /opt/splunk/etc/apps/bla/bin/myscript.py

In the spunkd log I find the following entry:

02-19-2020 13:25:39.278 +0100 ERROR ModularUtility - Specified filename "..." not found in search path.
...

But the script is definitely there. Kindly help me to find out what I´m missing.

Best Regards Falko

[manjunathmeti · Accepted solution]

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml

[flk2309]

Hello,

thank you. This works fine.

Another question I have now is, how can I trigger this alert manually to develop the script? When I run it in the search, the script is not triggered. Is there any way?

Thanks and best regards

Falko

[manjunathmeti]

Is you script reading any inputs?

If not you can use sendalert command to trigger this alert action.

 <your_search> | sendalert myscript

[flk2309]

Works fine. Thank you!

[manjunathmeti]

You are welcome. Please accept the answer.