topic Re: cutom alert action python script in Alerting

cutom alert action python script

pipipipi — Wed, 12 Feb 2020 08:55:23 GMT

Hi all. I am struggling where should I check.

I want to make splunk user automatically.
so, I made this script.

test.py

import sys
import os
import request
import json

def test():

data = { 'name':'username', 'password':'password', 'roles':'user'}


response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))


id __name__ == "__main__":
 test()

I can execute this scripts python test.py in my /home directory,

and I can create user.

so I made custom alert action.

I made an alert and select this custom action, but I can not create user.

I have no idea because there are no error in internal log(splunkd.log).

where should I check???

Re: cutom alert action python script

manjunathmeti — Wed, 12 Feb 2020 09:20:53 GMT

Please share configurations created for custom alert action.

Re: cutom alert action python script

pipipipi — Wed, 12 Feb 2020 09:24:56 GMT

Thank you for helping me. I use add-on builder. so I did not edit conf files.

Re: cutom alert action python script

harsmarvania57 — Wed, 12 Feb 2020 10:13:53 GMT

Search logs in splunkd.log for your alert action, you can use below query.

index=_internal sourcetype=splunkd component=sendmodalert

Re: cutom alert action python script

manjunathmeti — Wed, 12 Feb 2020 10:16:51 GMT

You are importing request, it should be requests.

Re: cutom alert action python script

pipipipi — Thu, 13 Feb 2020 01:14:18 GMT

Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):and return0

Re: cutom alert action python script

manjunathmeti — Thu, 13 Feb 2020 02:49:46 GMT

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)