topic Re: Missing --execute Argument in Custom Alert App in Alerting

Missing --execute Argument in Custom Alert App

secphilomath1 — Thu, 16 Mar 2023 20:37:27 GMT

I am working on a custom alert app to replace our old custom alert script action. It was working fine but all of sudden I am no longer getting the --execute argument being passed and my script doesn't work any more.

Here is the code:

if __name__ == "__main__": #clear logs now = datetime.now() dt_string = now.strftime("%d/%m/%Y %H:%M:%S") log(dt_string + ": Start Version 1.2","w") log("Checking to see if we have any arguments...") log("Number of arguments: " + str(len(sys.argv))) if len(sys.argv) > 1 and sys.argv[1] == "--execute": log("We have arguments.") try: payload = json.loads(sys.stdin.read()) result_file = payload['results_file'] #Pass the payload to main for processing.... main(payload) #End now = datetime.now() dt_string = now.strftime("%d/%m/%Y %H:%M:%S") log(dt_string + ": Processing complete.") except: log("We have an error on settings, exiting") sys.exit() else: log("There were no arguments. Exiting.") sys.exit()

Here is the output of my logging:

16/03/2023 10:55:16: Start Version 1.2 Checking to see if we have any arguments... Number of arguments: 1 There were no arguments. Exiting.

I have no idea what the --execute argument is and how it is passed, or what it actually means and can't find anything much about it Hoping to shed some light here

thanks!

Re: Missing --execute Argument in Custom Alert App

yeahnah — Thu, 16 Mar 2023 23:55:53 GMT

Hi @secphilomath1

After you configure a test alert and define your custom alert action as a triggered action, when Splunk calls the alert action script it passes the --execute as the first command line parameter.

https://dev.splunk.com/enterprise/docs/devtools/customalertactions/writescriptcaa

Basically, something like this...

python _myalertscript.py_ --execute < _myalert_result_payload.json_

How are you testing you alerting script?

Re: Missing --execute Argument in Custom Alert App

secphilomath1 — Thu, 16 Mar 2023 23:57:39 GMT

Cool thanks for the reference info, but mine all of a sudden isn't passing the --execute and then is failing. Can you think of a reason why it wouldn't pass that, the script is being called by the custom alert app.

Re: Missing --execute Argument in Custom Alert App

yeahnah — Fri, 17 Mar 2023 01:11:36 GMT

That sounds weird alright.

I guess you've tried a Splunk restart?

What do the internal logs show (Settings > Alert actions > View log events). Any errors showing up?

Also, the new Slunk Dev Portal docs are pretty poor. The old docs were better. I found an archived copy here, if that helps.

http://web.archive.org/web/20220519181621/http://docs.splunk.com:80/Documentation/Splunk/latest/AdvancedDev/CustomAlertScript