Alerting

Error Code=3

mbarbaro
Path Finder

06-26-2017 15:30:54.878 +0200 WARN sendmodalert - action=sendmail_action - Alert action script returned error code=3

Hello, someone know what mens error code 3 ???

Thanks in advance

woodcock
Esteemed Legend

This just means that the script being called did not run to completion.
I recently had a confusing problem that caused this exact error.
I had a working design where I had a sendalert named "my_send_alert" which called a python script named "my_send_alert.py" which then called a shell script named "my_send_alert_alt.sh".  It all worked great.  So I cloned it to create a different one and it didn't work, giving this error.  The problem ended up being that I named the shell script the same name as the python script and splunk was SKIPPING calling the python script and was calling the shell script directly!  I simply changed the name of the shell script and all was well.  So in summary: All 3 named the same does not work.

This DOES NOT work:

my_send_alert(alert_actions.conf) -> my_send_alert.py -> my_send_alert.sh


This DOES work:

my_send_alert(alert_actions.conf) -> my_send_alert.py -> my_send_alert_alt.sh


This should also work:

my_send_alert(alert_actions.conf) -> my_send_alert.sh
0 Karma

japger_splunk
Splunk Employee
Splunk Employee

If this issue was resolved, what was the fix? Permissions? Thanks.

0 Karma

Statixs
Engager

Hi Mbarbaro,

I have had the same error for my own technical addon and by looking at the source code of the alerts script, error code 3 seems related to input parameters not being correctly parsed or value None (null), resulting in the alert script to quit.

If you are trying to add search results to the email message, use the $result.$ to add that specific field value. For example, if you want to add the value of the field user from your search results, this would be accomplished with $result.user$

0 Karma

Richfez
SplunkTrust
SplunkTrust

Could you provide the exact Splunk version you are working with?

And is that the exact string returned?

I'd suggest perhaps narrowing down the issue by creating a new alert with a little selected as possible. Then add one thing at a time to it and see when it fails.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...