topic Re: Strange message for SMS Alert in Splunk Search

Strange message for SMS Alert

qiaojing — Fri, 22 Jul 2016 08:51:31 GMT

Hi, I'm currently trying to implement SMS Alert for Splunk. I have a SMS Gateway server in my organisation and I'm using it to send SMS alert.

I'm able to receive the SMS but the message was a long strange of nonsensical alphabets.

May I know if there's any formatting of the Splunk Alert that led to this? Or how can I configure the message such that the message sent via SMS is in human readable format.

Any help or idea will be greatly appreciated. Thank you 🙂

Re: Strange message for SMS Alert

woodcock — Fri, 22 Jul 2016 12:58:22 GMT

Your joking, right? What are the details of your server? How are you alerting to it (slunkbase app, custom command, modular alert)? What are the details here?

Re: Strange message for SMS Alert

acharlieh — Sun, 24 Jul 2016 14:18:20 GMT

If I had to guess it sounds like a character encoding problem somewhere along the line, whether that's whatever modular alert you're using with Splunk or the SMS Gateway.

Re: Strange message for SMS Alert

qiaojing — Mon, 25 Jul 2016 02:52:43 GMT

Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not include any of the details in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

Re: Strange message for SMS Alert

qiaojing — Mon, 25 Jul 2016 02:54:00 GMT

Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it. The server is an internal organisation server.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not check any of the details included in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

Re: Strange message for SMS Alert

qiaojing — Thu, 28 Jul 2016 03:18:27 GMT

@acharlieh Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not include any of the details in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

Re: Strange message for SMS Alert

qiaojing — Thu, 28 Jul 2016 03:18:51 GMT

@woodcook Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it. The server is an internal organisation server.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not check any of the details included in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

Re: Strange message for SMS Alert

Jeremiah — Thu, 28 Jul 2016 04:46:29 GMT

You might want to take a look at this answer:

https://answers.splunk.com/answers/140254/how-to-set-alert-emails-to-send-in-plain-text-in-splunk-6.html

We actually saw a similar problem with sending emails directly from Splunk to our pager gateway. Now we aggregate alerts in our event management tool, and send the pages from there.

Re: Strange message for SMS Alert

newbie2tech — Wed, 24 May 2017 15:35:37 GMT

@qiaojing did you get this working...if so can you share how

Re: Strange message for SMS Alert

woodcock — Wed, 24 May 2017 16:05:36 GMT

Are you SENDING an SMS or are you indexing SMS text into Splunk? If the former, how are you doing this (sending SMS is not a native Splunk capability). These are ABSOLUTELY CRITICAL details which you have not shared.