Alerting

Help with app or alert that is not firing

paries
Explorer

Hello,
I have an app/plugin installed (glips Alerts)
i have modified it slightly to work for our environment.
I can not get it to work with alerts and looking for some help on how to debug it.

i have a couple of debug statements in the glip.py

 sys.stdout = open("c:\\temp\\glip_plugin.log", "w")
 print >> sys.stdout, sys.argv

if i do this in the search

host="PROD-API" | spath Path | search Path="/api/CheckAuth"| spath "LogData.AUTH.Status" | search "LogData.AUTH.Status" != Success | sendalert glip param.webhook_url="https://hooks.glip.com/webhook/xxxxxxxxxxxxxxxxxxxxxxxxxxxx" param.message="$result.LogData.AUTH.Request$" param.title="API CHECKAUTH" param.activity=" Api 2.0 Auth Error Alert" param.uniquelogid="$result.UniqueLogId$"

i get the notice, and in the log file i see that glip.py has been called.

The problem is my alert is not calling it. I see nothing in the glip_plugin.log

The search for the alert is the same as above .

Is it safe to say that since the "sendalert glip" command appears to work that it must be the way i set up the alert?

the alert is set up as
alt text

Any suggestions on how to debug (still a newb at this ) would be great , thanks

Tags (2)
0 Karma
1 Solution

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

View solution in original post

0 Karma

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...