Calling REST API from Splunk on alert

Question

I need to implement two items using Splunk alert

1) Whenever an alert is triggered, it will call an REST API with the values from alerts.

2) On response REST API will be sending a list of email id as response. Splunk alert system has to use these email ids for sending the alert.

Please help me out how can I set up this in Splunk.

Thanks in advance.

Answer 1

You will have to create a script on the Splunk frontend server which does all the action. The script may be in any language you like, as long as it can run on the server. So bash, python, ruby... whatever you prefer. Alert scripts are documented here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Alert/Configuringscriptedalerts