ITSI Custom Alert Action issue

New Member

We have created the custom Action in ITSI to POST the Episode data to outside world.

Steps taken for creation of Custom action:

  1. Created App
  2. Created Python Script in Bin Folder of application
  3. Alert_action.conf creation inside the app
  4. Added <AppName> stanza in notable_event_action.conf in ITSI SA-ITOA Folder

After this the Action name is visible in Action drop down menu of ITSI Episode.


Whenever we are selecting the custom action it is throwing error.

Action = "AppNme" failed to run. Refer logs for more information.

When we refer the appserver.log it is giving us the below error

Can anyone please help on this, How to deal with this kind of error ? It seems Action itself is not getting called from ITSI what are your views ?

Error log-
Status="Started", FunctionName="actionExecution", actionInternalName="iPaaS"
2020-06-24 17:01:47,601 INFO [appserver] [notable_event_actions] [get_event_ids] [12252] is_group=True. action_name=`iPaaS` received=`[u'90cb2e34-08f4-463b-a395-4ce4a383e198']`

2020-06-24 17:01:47,603 INFO [appserver] [notable_event_actions] [execute_action] [12252] Generated search command=`search `itsi_event_management_group_index
` itsi_group_id="90cb2e34-08f4-463b-a395-4ce4a383e198" | dedup itsi_group_id | fields * | `itsi_notable_event_actions_temp_state_values` | `itsi_notable_group_lookup` | `itsi_notable_event_actions_coalesce_state_values` | sendalert "iPaaS" param.url=" "` for action=`iPaaS` with earliest_time=None, latest_time=None

2020-06-24 17:01:48,303 ERROR [appserver] [notable_event_actions] [_parse_and_call_execute_action] [12252] Actions (iPaaS) failed to execute on: [u'90cb2e34-
08f4-463b-a395-4ce4a383e198']. Error: search `itsi_event_management_group_index` itsi_group_id="90cb2e34-08f4-463b-a395-4ce4a383e198" | dedup itsi_group_id
| fields * | `itsi_notable_event_actions_temp_state_values` | `itsi_notable_group_lookup` | `itsi_notable_event_actions_coalesce_state_values` | sendalert
"iPaaS" param.url=" "  search failed. Refer search.log at "/services/search/jobs/1593014507.15717/search.log".

2020-06-24 17:01:48,303 INFO [appserver] [notable_event_actions] [_parse_and_call_execute_action] [12252] actionId="None", actionName="notable_event_action",
Status="Failed", FunctionName="actionExecution

Labels (3)
0 Karma

New Member

Can you check Search logs mentioned into the error,  could be permissions on the  app to ensure that they are set to Global or App instead of Private.  Also, could there be some restriction on the user you are accessing Splunk ?

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...