Alerting

cutom alert action python script

pipipipi
Path Finder

Hi all. I am struggling where should I check.

I want to make splunk user automatically.
so, I made this script.

test.py

import sys
import os
import request
import json

def test():

data = { 'name':'username', 'password':'password', 'roles':'user'}


response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))


id __name__ == "__main__":
 test()

I can execute this scripts python test.py in my /home directory,

and I can create user.

so I made custom alert action.

I made an alert and select this custom action, but I can not create user.

I have no idea because there are no error in internal log(splunkd.log).

where should I check???

0 Karma
1 Solution

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

View solution in original post

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

harsmarvania57
Ultra Champion

Search logs in splunkd.log for your alert action, you can use below query.

index=_internal sourcetype=splunkd component=sendmodalert
0 Karma

pipipipi
Path Finder

Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):and return0

0 Karma

manjunathmeti
Champion

Please share configurations created for custom alert action.

0 Karma

pipipipi
Path Finder

Thank you for helping me. I use add-on builder. so I did not edit conf files.

0 Karma

manjunathmeti
Champion

You are importing request, it should be requests.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...