Alerting

cutom alert action python script

pipipipi
Path Finder

Hi all. I am struggling where should I check.

I want to make splunk user automatically.
so, I made this script.

test.py

import sys
import os
import request
import json

def test():

data = { 'name':'username', 'password':'password', 'roles':'user'}


response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))


id __name__ == "__main__":
 test()

I can execute this scripts python test.py in my /home directory,

and I can create user.

so I made custom alert action.

I made an alert and select this custom action, but I can not create user.

I have no idea because there are no error in internal log(splunkd.log).

where should I check???

0 Karma
1 Solution

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

View solution in original post

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

harsmarvania57
Ultra Champion

Search logs in splunkd.log for your alert action, you can use below query.

index=_internal sourcetype=splunkd component=sendmodalert
0 Karma

pipipipi
Path Finder

Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):and return0

0 Karma

manjunathmeti
Champion

Please share configurations created for custom alert action.

0 Karma

pipipipi
Path Finder

Thank you for helping me. I use add-on builder. so I did not edit conf files.

0 Karma

manjunathmeti
Champion

You are importing request, it should be requests.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...