Error Code=3

[mbarbaro]

06-26-2017 15:30:54.878 +0200 WARN sendmodalert - action=sendmail_action - Alert action script returned error code=3

Hello, someone know what mens error code 3 ???

Thanks in advance

[woodcock]

This just means that the script being called did not run to completion.
I recently had a confusing problem that caused this exact error.
I had a working design where I had a sendalert named "my_send_alert" which called a python script named "my_send_alert.py" which then called a shell script named "my_send_alert_alt.sh".  It all worked great.  So I cloned it to create a different one and it didn't work, giving this error.  The problem ended up being that I named the shell script the same name as the python script and splunk was SKIPPING calling the python script and was calling the shell script directly!  I simply changed the name of the shell script and all was well.  So in summary: All 3 named the same does not work.

This DOES NOT work:

my_send_alert(alert_actions.conf) -> my_send_alert.py -> my_send_alert.sh

This DOES work:

my_send_alert(alert_actions.conf) -> my_send_alert.py -> my_send_alert_alt.sh

This should also work:

my_send_alert(alert_actions.conf) -> my_send_alert.sh

[spy_jr]

Hello @woodcock 
A question, in your post I see that you talk about some scripts, I wanted to know if those allow you to stop the error=3 when you run a search and it doesn't return any results
Currently I need to run correlations search with the command at the end "... | sendalert risk ... "
But when there are no results it throws that error and the whole correlation search is truncated, and for that reason I wanted to know if there is a way to abort the sendalert risk when there are no results 

[japger_splunk]

If this issue was resolved, what was the fix? Permissions? Thanks.

[Statixs]

Hi Mbarbaro,

I have had the same error for my own technical addon and by looking at the source code of the alerts script, error code 3 seems related to input parameters not being correctly parsed or value None (null), resulting in the alert script to quit.

If you are trying to add search results to the email message, use the $result.$ to add that specific field value. For example, if you want to add the value of the field user from your search results, this would be accomplished with $result.user$

[Richfez]

Could you provide the exact Splunk version you are working with?

And is that the exact string returned?

I'd suggest perhaps narrowing down the issue by creating a new alert with a little selected as possible. Then add one thing at a time to it and see when it fails.