Run a custom script

[syedsaadat]

I came across of running a custom python script in Splunk on the triggered events by adding the run a script action but I don't know how to do it. As the alerts are visible on Splunk I want to run a script and extract those triggered alerts by running a script.

[_JP]

You can create a Custom Alert Action that is backed by your python script:

Using custom alert actions - Splunk Documentation

And here's the developer details on how you need to set things up:

https://dev.splunk.com/enterprise/docs/devtools/customalertactions/

[syedsaadat]

I tried implementing slack app but unable to send alerts to splunk so can you guide me through how to use the app to send alerts without using webhook.

[richgalloway]

Where did you come across this feature?  As I recall, Splunk removed the ability to run a script as an alert action years ago.

[syedsaadat]

Yes I came across that thing. So is there a alternative way to run python scripts?

[_JP]

The old way of just running a python script as an alert action was deprecated a while back.  It was a really simple, "run script and here's the search data."  That way is old and busted...so it is not around anymore.

The new hotness is Custom Alert Actions.  You can create one that runs your python.  There's some more setup/configuration so it is registered with the system and more effort goes into packaging it up as an official configuration in Splunk (official as in you made it for your environment...).

Here is a previous discussion on this topic, too.