Running php script in alert with adding results as arguments

[damiko]

Hello Ninjas!
I need help with setting an alert which triggers a php script with results. This script should pass the results to 3rd party system.
For example: script.php "date | field1 | field 2 | _raw "

[manjunathmeti]

Python script runs php script like below:

/usr/bin/php /opt/splunk/etc/apps/alert_action/bin/my_script.php "2020-02-24 | 404 | /mail-app/api/v2/subscription | 82.200.xx.xx - text message"

Check if this command works.

[damiko]

Yeah this works when I'm running it from cmd line.

Any method to troubleshoot my alert?

[manjunathmeti]

Replace content of python script with below code and check. Now this code directly reads results file.

#!/usr/bin/python
import sys
import subprocess
import json
import csv
import gzip
if __name__ == "__main__":
    rows = []
    if len(sys.argv) < 2 or sys.argv[1] != "--execute":
        print >> sys.stderr, "FATAL Unsupported execution mode (expected --execute flag)"
        sys.exit(1)
    settings = json.loads(sys.stdin.read())
    config = settings['configuration']
    results_file = settings['results_file']
    trigger_date = config.get('trigger_date')
    try:
        with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile:
            reader = csv.DictReader(rfile, lineterminator="\n")
            for row in reader:
                rows.append({str(k): v for k, v in row.items() if not k.startswith("__mv_")})
    except Exception as e:
        print("Reading %s failed. Error: %s" % (results_file, e))
        sys.exit(2)
    for row in rows:
        inputs = "%s | %s | %s | %s" % (trigger_date, row['status'], row['uri_path'], row['_raw'])
        command = "%s %s %s" % ("/usr/bin/php", "/opt/splunk/etc/apps/alert_action/bin/my_script.php", inputs)
        try:
            p = subprocess.Popen(command, stdin=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
            out, error = p.communicate()
            if error:
                print(error)
            if out:
                print(out)
        except Exception, e:
            print ("ERROR Unexpected error: %s" % e)
            sys.exit(3)

[damiko]

changed code in my_script.py. However still blank fields.
from _internal: 02-24-2020 16:23:30.752 +0600 INFO sendmodalert - action=my_script - Alert action script completed in duration=7905 ms with exit code=0

[manjunathmeti]

I am getting this command splunk logs. Looks like input parameter to php script should be in quotes. Check if below command works.

/usr/bin/php /opt/splunk/etc/apps/alert_action/bin/my_script.php '2020-02-24 | 200 | /servicesNS/nobody/splunk_app_for_nix/saved/searches/fired_alerts/notify | 127.0.0.1 - splunk-system-user [24/Feb/2020:10:40:05.115 +0000] "POST /servicesNS/nobody/splunk_app_for_nix/saved/searches/fired_alerts/notify?trigger.condition_state=1 HTTP/1.1" 200 1981 - - - 5ms'

If this works, use below code and check:

#!/usr/bin/python
import sys
import subprocess
import json
import csv
import gzip
if __name__ == "__main__":
    rows = []
    if len(sys.argv) < 2 or sys.argv[1] != "--execute":
        print >> sys.stderr, "FATAL Unsupported execution mode (expected --execute flag)"
        sys.exit(1)
    settings = json.loads(sys.stdin.read())
    config = settings['configuration']
    results_file = settings['results_file']
    trigger_date = config.get('trigger_date')
    try:
        with gzip.open(results_file.rstrip('\r\n'), 'rb') as rfile:
            reader = csv.DictReader(rfile, lineterminator="\n")
            for row in reader:
                rows.append({str(k): v for k, v in row.items() if not k.startswith("__mv_")})
    except Exception as e:
        print("Reading %s failed. Error: %s" % (results_file, e))
        sys.exit(2)
    for row in rows:
        inputs = "'%s | %s | %s | %s'" % (trigger_date, row['status'], row['uri_path'], row['_raw'])
        command = "%s %s %s" % ("/usr/bin/php", "/opt/splunk/etc/apps/alert_action/bin/my_script.php", inputs)
        try:
            p = subprocess.Popen(command, stdin=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
            out, error = p.communicate()
            if error:
                print(error)
            if out:
                print(out)
        except Exception, e:
            print ("ERROR Unexpected error: %s" % e)
            sys.exit(3)

[damiko]

Nevermind, I've deleted spaces on each row. Now it's WORKING! Great! Thank you @manjunathmeti
What changes I could make in your python code to add more fields?

[manjunathmeti]

That's great! You can update variable inputs in the code:

inputs = "'%s | %s | %s | %s | %s | %s | %s'" % (trigger_date, row['status'], row['uri_path'], row['_raw'], row['MORE_FIELD_1'], row['MORE_FIELD_2'], row['MORE_FIELD_3'])

And add MORE_FIELD_1, MORE_FIELD_2 and MORE_FIELD_3 in search.

[damiko]

Hey, @manjunathmeti ! I've got a problem, can't add new fields to script. Below is changes I made in your code and Errors I'm getting in _internal

for row in rows:
        inputs = "'%s | %s | %s | %s | %s | %s | %s'" % (trigger_date, row['status'], row['uri_path'], row['_raw'], row['description'], row['ftime'], row['service'])
        command = "%s %s %s" % ("/usr/bin/php", "/opt/splunk/etc/apps/alert_action_php/bin/my_script.php", inputs)

[manjunathmeti]

There is a KeyError: 'description'. It means description field is not there in your search results. Make sure all the fields you are adding are there in search results.

[damiko]

No worries, I forgot to add params in alert_action.conf. It's working now

[damiko]

It's in my search query. I've added them in |table command. Mb I need to add them in alert_action.conf? result.description and etc

[damiko]

Ok, thanks, will try later!

[damiko]

Now I'm receiving this WARN
please check the image

[manjunathmeti]

There is an indentation error in the script. Copy python code as it is and remove first space from each line.

[damiko]

Thank you manjunathmeti. The environment where I was testing it is blocked on weekend, I'll try your python method on Monday. Have a good weekend 🙂

[damiko]

Hey, thank you. I didn't finish setting yet, wanted to ask you: Where do I put savedsearches.conf?
Or should I change current savedsearches.conf?

[manjunathmeti]

You should change existing savedsearches.conf.