# Access Splunk alerts through ansible **URL:** \ **Category:** Ansible Project\ **Created:** [August 20, 2018, 4:37pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369 "2018-08-20T16:37:21Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 20, 2018, 4:37pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/1 "2018-08-20T16:37:21Z")
I would like to access Splunk alerts through ansible. We have several alerts in Splunk which we wants to access through ansible. Please do let me know can we access splunk alerts via ansible. If so, let me know the steps. ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [August 20, 2018, 4:39pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/2 "2018-08-20T16:39:17Z")
can you describe more what are you trying to do with those alerts? you need to go into more detail in what you are trying to do. ---
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 22, 2018, 5:23am UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/3 "2018-08-22T05:23:30Z")
Hi, Thanks for your email. We have created number of alerts in Splunk for our project environment (dev, uat, production), now we would like to call these alerts through ansible / ansible tower. Because we have limited access in splunk and wants to execute / check the alert result. Is there a way to access these alerts via ansible command or ansible tower. ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [August 22, 2018, 5:27am UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/4 "2018-08-22T05:27:51Z")
you might be able to use the uri modules and conditionals but, I haven’t tried it with splunk. ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [August 22, 2018, 5:42am UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/5 "2018-08-22T05:42:27Z")
or better if splunk can do curl/api calls to tower then that’s a better option. ---
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 27, 2018, 11:27am UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/6 "2018-08-27T11:27:10Z")
Hi, Thanks for your email. Can we create splunk alert from ansible / ansible tower. I would like to write a ansible script to create the splunk alert from ansible, just like we create EC2 instance from ansible script. ---
**Author:** ![Mark\_Phillips](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Mark\_Phillips](https://forum.ansible.com/u/Mark_Phillips)\ **Post date:** [August 28, 2018, 11:20am UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/7 "2018-08-28T11:20:53Z")
Hello Pradeep, When you say ‘access Splunk alerts’ how do you mean? Would you like the Splunk alert to do something with Ansible? Maybe trigger an Ansible playbook run? If you can talk of the specific scenario that would be most helpful. Thanks! ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [August 28, 2018, 12:00pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/8 "2018-08-28T12:00:11Z")
have you configured logging yet ? [https://docs.ansible.com/ansible-tower/latest/html/userguide/logging\_in.html](https://docs.ansible.com/ansible-tower/latest/html/userguide/logging_in.html) ---
**Author:** ![Ravi\_Reddy](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@Ravi\_Reddy](https://forum.ansible.com/u/Ravi_Reddy)\ **Post date:** [August 28, 2018, 5:04pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/9 "2018-08-28T17:04:52Z")
Yes, you can create alerts from configuration files in splunk. You can write a playbook and update the savedsearches.conf for the specific app you want to create alert and then reload alerts ([https://127.0.0.1:8089/services/data//ui/alerts/\_reload](https://127.0.0.1:8089/services/data//ui/alerts/_reload)) To Just access the savedsearches you can run a rest call to [https://127.0.0.1:8089/services/saved/searches](https://127.0.0.1:8089/services/saved/searches) ---
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 28, 2018, 5:26pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/10 "2018-08-28T17:26:22Z")
Hi Ravi, Thanks for your response. I am unable to open your given url (([https://127.0.0.1:8089/services/data//ui/alerts/\_reload](https://127.0.0.1:8089/services/data//ui/alerts/_reload)), [https://127.0.0.1:8089/services/saved/searches](https://127.0.0.1:8089/services/saved/searches)) , can you please email the file and screen shot so that I can create my ansible script to create splunk alert from Ansible. I would like to write a ansible script to create the splunk alert from ansible, just like we create EC2 instance from ansible script with EC2 module. ---
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 28, 2018, 5:28pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/11 "2018-08-28T17:28:17Z")
Yes please. But I would like to write a ansible script to create the splunk alert from ansible, just like we create EC2 instance from ansible script with EC2 module. I didn’t find splunk module in ansible to create alert. ---
**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\ **Post date:** [August 28, 2018, 5:31pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/12 "2018-08-28T17:31:35Z")
Hi Mark, Thanks for your email. I would like to write a ansible script to create the splunk alert from ansible, just like we create EC2 instance from ansible script with EC2 module. Developer can run this script and create the splunk alert for their package alert. they can simply pass the parameters and create the splunk alert via ansible script. Because we have limited access in Splunk. I didn’t find splunk module in ansible to create alert. ---
**Author:** ![Ravi\_Reddy](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@Ravi\_Reddy](https://forum.ansible.com/u/Ravi_Reddy)\ **Post date:** [August 28, 2018, 5:33pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/13 "2018-08-28T17:33:48Z")
Thats just localhost rest end point, use your search head IP/fqdn instead of 127.0.0.1. Configuration file path depends on the app in which you want to create the alert. for example if you want to create alert in search & reporting app, the location would be $SPLUNK\_HOME/etc/apps/search/local/savedsearches.conf ---
**Author:** ![Mark\_Phillips](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Mark\_Phillips](https://forum.ansible.com/u/Mark_Phillips)\ **Post date:** [August 28, 2018, 5:46pm UTC](https://forum.ansible.com/t/access-splunk-alerts-through-ansible/28369/14 "2018-08-28T17:46:49Z")
Ah, I understand now. OK, so it’s Splunk configuration. I think somebody else mentioned in this thread the config file you need to change. That, of course, is pretty easy to do with Ansible – you could use a template[1], or lineinfile[2] (if it’s a single line, that is – otherwise the template module is far more suitable). You say you have limited access to Splunk – that may prove to be a problem, as changing configuration files will require restarting Splunk. Cheers [1] [https://docs.ansible.com/ansible/latest/modules/template\_module.html](https://docs.ansible.com/ansible/latest/modules/template_module.html) [2] [https://docs.ansible.com/ansible/latest/modules/lineinfile\_module.html](https://docs.ansible.com/ansible/latest/modules/lineinfile_module.html)