I was talking to some Splunk Users and mentioned scripted alerts as a very powerful way to invoke any program to get an alert. My thoughts then came to audible alerts. Since a scripted alert can call anything, it is possible that the script can call a program that can remotely send an alert that is audible, not just readable (like an email alert). I can think of a simple use case for this. Suppose you already have alerts that go to your cell phone via SMS through the email alert function of Splunk. Now, if you are at home and your cell phone battery is dead and it needs to be recharged, you may miss an important alert until you turn on your cell phone. As a back up, if an alert can go to some other device that is always on, such as a voice enabled device, you’ll have another opportunity to get the alert.
First, you’ll need to have a device that that can translate text to speech via a remote API. I chose to use a Nabaztag:Tag for this function. What’s this? It’s a voice enabled wifi rabbit that can receive multiple types of audible input including RSS, audio streams, and text to speech. What I did was set up a scripted input with environment variables on what to say, which included the name of the saved search, the number of events matched, and a readable subject. To make it more interesting, I added a day of the week (daily, weekdays, weekend) and start to end hours environment variables to control when the alert can be active. In a real life situation, you would want the alert to be active during your evening hours at home such as 6 PM to 11 PM. The script then calls a Python program that checks the time to be active, puts the final alert together as a String and then calls a Nabaztag REST based API to send the alert to the rabbit. The call to send the alert looks something like this:
http://api.nabaztag.com/vl/FR/api.jsp?sn=00039D4022DE&token=112231049046144&voice=UK-Shirley&tts=Splunk+Alert+...
The sn and token identify which rabbit to send the alert to, the voice identifies the accent and language, while the tts is the actual text to be read. When executed, the rabbit lights up and speaks the alert. It will also flash with color until a button is pressed which will again speak the alert in case you missed it the first time.
This example may sound a little playful as it uses a consumer gadget to serve the purpose. However, it illustrates that alerts do not always have to be textual in nature and can be as useful and creative as your imagination can conceive them. You can download the wifi rabbit example at Splunkbase and start using the same approach for your own audible device. Happy Belated Easter!
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.