topic Re: Custom Alert reaction with Python in Splunk Dev

Custom Alert reaction with Python

flk2309 — Wed, 30 Sep 2020 04:14:37 GMT

Hello,

I want to trigger a a Python script as reaction to an alert. I have added the stanza to alert_actions.conf and restarted Splunk:

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml
filename = myscript.py
alert.execute.cmd = /opt/splunk/etc/apps/bla/bin/myscript.py

In the spunkd log I find the following entry:

02-19-2020 13:25:39.278 +0100 ERROR ModularUtility - Specified filename "..." not found in search path.
...

But the script is definitely there. Kindly help me to find out what I´m missing.

Best Regards Falko

Re: Custom Alert reaction with Python

manjunathmeti — Wed, 19 Feb 2020 15:48:07 GMT

Just try with below configurations in alert_actions.conf.

[myscript]
is_custom = 1
disabled = 0
label = myscript
description = myscript
track_alert = 1
ttl = 600
maxtime = 5m
icon_path = alert_manager_icon.png
payload_format = xml

Re: Custom Alert reaction with Python

flk2309 — Thu, 20 Feb 2020 12:57:04 GMT

Hello,

thank you. This works fine.

Another question I have now is, how can I trigger this alert manually to develop the script? When I run it in the search, the script is not triggered. Is there any way?

Thanks and best regards

Falko

Re: Custom Alert reaction with Python

manjunathmeti — Thu, 20 Feb 2020 13:12:21 GMT

Is you script reading any inputs?

If not you can use sendalert command to trigger this alert action.

 <your_search> | sendalert myscript

Re: Custom Alert reaction with Python

flk2309 — Thu, 20 Feb 2020 14:09:05 GMT

Works fine. Thank you!

Re: Custom Alert reaction with Python

manjunathmeti — Thu, 20 Feb 2020 14:26:49 GMT

You are welcome. Please accept the answer.