Alerting

Is the alert script capability for alert actions restricted to the admin user or is there a setting I can change?

pduflot
Path Finder

Hello,

I have a python script as an alert action.
I could not make it work until I changed the owner of the alert to admin. Even when the owner had the admin role, the script was not called.
In the scheduler.log, I see alert_actions="" when the user is not the admin user.
While I see, alert_actions="script" when the user is the admin user.

Is this alert script capability restricted to the admin user or are there any other settings I can change?

Thanks,

0 Karma
1 Solution

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

View solution in original post

0 Karma

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...