Alerting

ITSI CustomGroupActionBase get_group() result

sboogaar
Path Finder

We are creating a custom action when an itsi event happens based on the CustomGroupActionBase as documenten here. However I cant find anywhere what data is expected to be returned when caling the get_group method.

When looking at the docs it says:

 

get_group()

Gets the episode that triggered the custom action. This method relies on get_results_file() and expects the returned file path to be a .csv.gz format.

 

The documentation of get_results_file says:

get_results_file()

Gets the results file, which is where results are temporarily stored.

 

We want to make sure the fields we currently see in the dict that is returned by get_group doesnt change, even better if we understand which file/where the data is coming from. We are afraid we use fields that are not always filled which would result in an error in our code.

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...