How to execute custom script on Universal Fowarder when Event Trigger Alert raised?
I am monitoring my linux audit logs, upon receiving event from the remote client (UF), I want to trigger an event alert which will execute a custom script on the remote client.
Reviewed the following but I'm not sure whether this will execute the script on the UF or on the SH which detects the event.
http://dev.splunk.com/view/dev-guide/SP-CAAAE68
Newbie
↧