ITSI Custom Alert Action issue

New Member

We have created the custom Action in ITSI to POST the Episode data to outside world.

Steps taken for creation of Custom action:

  1. Created App
  2. Created Python Script in Bin Folder of application
  3. Alert_action.conf creation inside the app
  4. Added <AppName> stanza in notable_event_action.conf in ITSI SA-ITOA Folder

After this the Action name is visible in Action drop down menu of ITSI Episode.


Whenever we are selecting the custom action it is throwing error.

Action = "AppNme" failed to run. Refer logs for more information.

When we refer the appserver.log it is giving us the below error

Can anyone please help on this, How to deal with this kind of error ? It seems Action itself is not getting called from ITSI what are your views ?

Error log-
Status="Started", FunctionName="actionExecution", actionInternalName="iPaaS"
2020-06-24 17:01:47,601 INFO [appserver] [notable_event_actions] [get_event_ids] [12252] is_group=True. action_name=`iPaaS` received=`[u'90cb2e34-08f4-463b-a395-4ce4a383e198']`

2020-06-24 17:01:47,603 INFO [appserver] [notable_event_actions] [execute_action] [12252] Generated search command=`search `itsi_event_management_group_index
` itsi_group_id="90cb2e34-08f4-463b-a395-4ce4a383e198" | dedup itsi_group_id | fields * | `itsi_notable_event_actions_temp_state_values` | `itsi_notable_group_lookup` | `itsi_notable_event_actions_coalesce_state_values` | sendalert "iPaaS" param.url=" "` for action=`iPaaS` with earliest_time=None, latest_time=None

2020-06-24 17:01:48,303 ERROR [appserver] [notable_event_actions] [_parse_and_call_execute_action] [12252] Actions (iPaaS) failed to execute on: [u'90cb2e34-
08f4-463b-a395-4ce4a383e198']. Error: search `itsi_event_management_group_index` itsi_group_id="90cb2e34-08f4-463b-a395-4ce4a383e198" | dedup itsi_group_id
| fields * | `itsi_notable_event_actions_temp_state_values` | `itsi_notable_group_lookup` | `itsi_notable_event_actions_coalesce_state_values` | sendalert
"iPaaS" param.url=" "  search failed. Refer search.log at "/services/search/jobs/1593014507.15717/search.log".

2020-06-24 17:01:48,303 INFO [appserver] [notable_event_actions] [_parse_and_call_execute_action] [12252] actionId="None", actionName="notable_event_action",
Status="Failed", FunctionName="actionExecution

Labels (3)
0 Karma

New Member

Can you check Search logs mentioned into the error,  could be permissions on the  app to ensure that they are set to Global or App instead of Private.  Also, could there be some restriction on the user you are accessing Splunk ?

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...