PSA: latest broken hosts app 4.2.2 has a bug

[Wiessiet]

For anyone using Hurricane Labs "Broken hosts" app (https://splunkbase.splunk.com/app/3247) note that the latest version, 4.2.2, appears to have a very minor but breaking bug. The file /default/savedsearches.conf has a stanza for the "Broken Hosts Alert - by contact" alert. Depending how you use the app, that potentially drives your entire alerting mechanism. Two lines in that file (121 & 130) wrap a built-in search macro in double quotes where they should not exist:

| fillnull value="`default_expected_time`" lateSecs

should be:

| fillnull value=`default_expected_time` lateSecs

The result of this is to assign the string value "`default_expected_time`" to the lateSecs variable, rather than expanding to whatever default integer you configured in the macro. Removing those double quotes from both lines seems to fix the issue. I've also raised an issue on the Hurricane Labs github page below...though activity there is pretty stale and I'm not sure if anyone is looking there...

https://github.com/HurricaneLabs/brokenhosts/issues/3

[richgalloway]

That's a supported app.  Have you contacted the developer?

[Wiessiet · Accepted solution]

Yes I have - that was the GitHub link I posted. Actually they were very quick to address it (and a second issue I found after identifying the first). It sounds like their GitHub code has been updated, but not the version loaded on SplunkBase yet.