topic Re: Does Slack Notification Alert app work with Splunk Cloud? in All Apps and Add-ons

Does Slack Notification Alert app work with Splunk Cloud?

andyscoggins — Tue, 29 Sep 2020 18:52:25 GMT

I had the Slack Notification Alert app installed in my instance of Splunk Cloud by the support team, as they require. I added the Webhook URL in Setup Slack Alerts.

When I run sendalert manually the message shows up in #mychannel:

search blahblahblah | sendalert slack param.channel="#mychannel" param.message="Found blahblahblah"

I set up a scheduled alert, added Slack as an action, and added #mychannel, but I never get the message and these errors are in splunkd.log (sensitive info removed):

04-04-2018 17:00:03.252 +0000 ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 5., search='sendalert slack results_file="REMOVED" results_link="REMOVED"'

04-04-2018 17:00:03.247 +0000 WARN sendmodalert - action=slack - Alert action script returned error code=5

04-04-2018 17:00:03.245 +0000 FATAL sendmodalert - action=slack STDERR - Invalid webhook URL specified. The URL must use HTTPS.

Any ideas on what may be causing the problem?

Thanks for any help.

Re: Does Slack Notification Alert app work with Splunk Cloud?

ziegfried — Wed, 04 Apr 2018 23:42:49 GMT

I assume this is version 1.1.0 of the app?

You could try to increase the logger level for alert actions temporarily to see more information in the logs:

Navigate to "Settings" -> "Server settings" -> "Server logging"
Search for the log channel "sendmodalert"
Select logging level "DEBUG"
NOTE: This will increase cause detailed logs to be produced for all alert actions and might have an
inpact on system performance. It is not recommended to do this on a production system.

Re: Does Slack Notification Alert app work with Splunk Cloud?

Azeemering — Thu, 05 Apr 2018 10:42:13 GMT

No this is not compatible on Splunk Cloud (yet)
This version is not yet available for Splunk Cloud.

See: https://splunkbase.splunk.com/app/2878/#/details

Re: Does Slack Notification Alert app work with Splunk Cloud?

andyscoggins — Thu, 05 Apr 2018 12:21:06 GMT

Thank you for confirming.

It seems that most of the things that I want to do aren't compatible with Splunk Cloud.

Re: Does Slack Notification Alert app work with Splunk Cloud?

andyscoggins — Thu, 05 Apr 2018 12:21:35 GMT

Thanks, but Splunk Cloud doesn't allow this level of debugging.

Re: Does Slack Notification Alert app work with Splunk Cloud?

ziegfried — Thu, 12 Apr 2018 00:22:40 GMT

Version 1.1.0 should be cloud compatible.

Re: Does Slack Notification Alert app work with Splunk Cloud?

leonards1 — Tue, 08 May 2018 20:24:18 GMT

Confused here..... Splunkbase shows this as compatible and I have had this running successfully on Splunk Cloud for the past year or so. We are currently at v1.0.1, although I notice that Splunkbase shows a v2.0.3 available.

Re: Does Slack Notification Alert app work with Splunk Cloud?

andyscoggins — Wed, 09 May 2018 13:44:35 GMT

That's interesting. I couldn't get v1.0.1 to work at all. I found a workaround, but may do more investigating if it's working for others.