Alerting

Help with app or alert that is not firing

paries
Explorer

Hello,
I have an app/plugin installed (glips Alerts)
i have modified it slightly to work for our environment.
I can not get it to work with alerts and looking for some help on how to debug it.

i have a couple of debug statements in the glip.py

 sys.stdout = open("c:\\temp\\glip_plugin.log", "w")
 print >> sys.stdout, sys.argv

if i do this in the search

host="PROD-API" | spath Path | search Path="/api/CheckAuth"| spath "LogData.AUTH.Status" | search "LogData.AUTH.Status" != Success | sendalert glip param.webhook_url="https://hooks.glip.com/webhook/xxxxxxxxxxxxxxxxxxxxxxxxxxxx" param.message="$result.LogData.AUTH.Request$" param.title="API CHECKAUTH" param.activity=" Api 2.0 Auth Error Alert" param.uniquelogid="$result.UniqueLogId$"

i get the notice, and in the log file i see that glip.py has been called.

The problem is my alert is not calling it. I see nothing in the glip_plugin.log

The search for the alert is the same as above .

Is it safe to say that since the "sendalert glip" command appears to work that it must be the way i set up the alert?

the alert is set up as
alt text

Any suggestions on how to debug (still a newb at this ) would be great , thanks

Tags (2)
0 Karma
1 Solution

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

View solution in original post

0 Karma

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...