Alerting

Help with app or alert that is not firing

paries
Explorer

Hello,
I have an app/plugin installed (glips Alerts)
i have modified it slightly to work for our environment.
I can not get it to work with alerts and looking for some help on how to debug it.

i have a couple of debug statements in the glip.py

 sys.stdout = open("c:\\temp\\glip_plugin.log", "w")
 print >> sys.stdout, sys.argv

if i do this in the search

host="PROD-API" | spath Path | search Path="/api/CheckAuth"| spath "LogData.AUTH.Status" | search "LogData.AUTH.Status" != Success | sendalert glip param.webhook_url="https://hooks.glip.com/webhook/xxxxxxxxxxxxxxxxxxxxxxxxxxxx" param.message="$result.LogData.AUTH.Request$" param.title="API CHECKAUTH" param.activity=" Api 2.0 Auth Error Alert" param.uniquelogid="$result.UniqueLogId$"

i get the notice, and in the log file i see that glip.py has been called.

The problem is my alert is not calling it. I see nothing in the glip_plugin.log

The search for the alert is the same as above .

Is it safe to say that since the "sendalert glip" command appears to work that it must be the way i set up the alert?

the alert is set up as
alt text

Any suggestions on how to debug (still a newb at this ) would be great , thanks

Tags (2)
0 Karma
1 Solution

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

View solution in original post

0 Karma

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...