Alerting

Configure a script as alert action for each result ip and send email

orca
Explorer

1. I have an alert scheduled to run every hour to get updated list of IPs of public nodes.

2. I need to run the script against each result IP and if output=success, I need to send email to specific DL to identify potential hacking activity from the IP.

possible? Can we measure the output of script execution and send email in same Alert action OR I should create the script to test the result and send email also from the script?

Any pointers or am i missing something?

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You can convert that script to a custom search command and use the inbuilt email alert action to send emails.

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

You can convert that script to a custom search command and use the inbuilt email alert action to send emails.

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/

If this reply helps you, an upvote/like would be appreciated.

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...