Using Splunk as a real-time event detection engine

[jsash1]

Hi,

I have a requirement for an event detection engine which is able to identify a string (e.g. username) in a particular data source and 'notify' other systems that the event has occurred.

I appreciate the inherent flexibility Splunk has by allowing Scripts to be used in conjunction with Alerts to achive this, but i wanted to see if anyone is using Splunk within a large enterprise Production environment as an event detection engine (instead of just a data visualisation tool)?

Once the event has occurred, Splunk will need to 'notify' other systems by sending a JMS message to one system and updating a database table in another system. How suitable is the scripting capability in Splunk for run-time requirements like this?

Cheers,
James.

[billford]

Sorry reading it on my phone, overlooked the actual question. Yes that should be no problem. You can script with pretty much anything. I generally use python or bash but to each his/her own. :). We often use external alerting to send an ip to a firewall to be dropped or to update a blacklist, etc. Same principle.

[billford]

Yes. All the time. What is your specific question?

[jsash1]

Once the event has occurred, Splunk will need to 'notify' other systems by sending a JMS message to one system and updating a database table in another system. How suitable is the scripting capability in Splunk for run-time requirements like this?