https://community.splunk.com/t5/Alerting/errors-in-custom-alert-action/m-p/474212#M9630 <P>Place python script <STRONG>splunk2alc.py</STRONG> in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.</P> <PRE><CODE> [splunk2alc] is_custom = 1 disabled = 0 label = Splunk2ALC description = Send Alert to Alc track_alert = 1 ttl = 600 maxtime = 5m icon_path = alert_manager_icon.png payload_format = xml </CODE></PRE> Wed, 19 Feb 2020 15:29:19 GMT manjunathmeti 2020-02-19T15:29:19Z https://community.splunk.com/t5/Alerting/errors-in-custom-alert-action/m-p/474211#M9629 <P>Hello,</P> <P>We created a custom alert action as per documentation and try to trigger it.<BR /> We get the following errors:</P> <PRE><CODE>2/19/20 4:01:42.547 PM 02-19-2020 16:01:42.547 +0100 ERROR SearchScheduler - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found., search='sendalert splunk2alc results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760/results.csv.gz" results_link="https://splunk-ml.zone1.mo.sap.corp:443/app/mlbso/@go?sid=scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760"' host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd 2/19/20 4:01:42.546 PM 02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found. host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd 2/19/20 4:01:42.546 PM 02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - action=splunk2alc - Failed to find alert.execute.cmd "python". host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd 2/19/20 4:01:42.544 PM 02-19-2020 16:01:42.544 +0100 INFO sendmodalert - Invoking modular alert action=splunk2alc for search="Crash Dump Alert ALC - AlertAction" sid="scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760" in app="mlbso" owner="d038423" type="saved" host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd 2/19/20 4:01:38.316 PM 02-19-2020 16:01:38.316 +0100 DEBUG sendmodalert - action=alert_manager - Token value action.splunk2alc=1 </CODE></PRE> <P>Our alect_actions.conf looks as follows:</P> <PRE><CODE>[splunk2alc] is_custom = 1 disabled = 0 label = Splunk2ALC description = Send Alert to Alc track_alert = 1 ttl = 600 maxtime = 5m icon_path = alert_manager_icon.png payload_format = xml alert.execute.cmd = python alert.execute.cmd.arg.0 = /opt/splunk/etc/apps/mlbso/bin/splunk2alc.py </CODE></PRE> <P>under the alert.execute.cmd we have tried already quite some combinations, like:</P> <PRE><CODE>$SPLUNK_HOME$/bin/python $SPLUNK_HOME/bin/python /opt/splunk/bin/python </CODE></PRE> <P>All throw same error.</P> <P>Any ideas?</P> <P>Kind Regards,<BR /> Kamil</P> Wed, 19 Feb 2020 15:20:19 GMT https://community.splunk.com/t5/Alerting/errors-in-custom-alert-action/m-p/474211#M9629 damucka 2020-02-19T15:20:19Z https://community.splunk.com/t5/Alerting/errors-in-custom-alert-action/m-p/474212#M9630 <P>Place python script <STRONG>splunk2alc.py</STRONG> in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.</P> <PRE><CODE> [splunk2alc] is_custom = 1 disabled = 0 label = Splunk2ALC description = Send Alert to Alc track_alert = 1 ttl = 600 maxtime = 5m icon_path = alert_manager_icon.png payload_format = xml </CODE></PRE> Wed, 19 Feb 2020 15:29:19 GMT https://community.splunk.com/t5/Alerting/errors-in-custom-alert-action/m-p/474212#M9630 manjunathmeti 2020-02-19T15:29:19Z