Building for the Splunk Platform

Custom Alert reaction with Python

flk2309
New Member

Hello,

I want to trigger a a Python script as reaction to an alert. I have added the stanza to alert_actions.conf and restarted Splunk:

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml
filename = myscript.py
alert.execute.cmd = /opt/splunk/etc/apps/bla/bin/myscript.py

In the spunkd log I find the following entry:

02-19-2020 13:25:39.278 +0100 ERROR ModularUtility - Specified filename "..." not found in search path.
...

But the script is definitely there. Kindly help me to find out what I´m missing.

Best Regards Falko

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml
0 Karma

flk2309
New Member

Hello,

thank you. This works fine.

Another question I have now is, how can I trigger this alert manually to develop the script? When I run it in the search, the script is not triggered. Is there any way?

Thanks and best regards

Falko

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Is you script reading any inputs?

If not you can use sendalert command to trigger this alert action.

 <your_search> | sendalert myscript
0 Karma

flk2309
New Member

Works fine. Thank you!

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You are welcome. Please accept the answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...