- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all. I am struggling where should I check.
I want to make splunk user automatically.
so, I made this script.
test.py
import sys
import os
import request
import json
def test():
data = { 'name':'username', 'password':'password', 'roles':'user'}
response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
id __name__ == "__main__":
test()
I can execute this scripts python test.py
in my /home directory,
and I can create user.
so I made custom alert action.
I made an alert and select this custom action, but I can not create user.
I have no idea because there are no error in internal log(splunkd.log).
where should I check???
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Add exception handling in your script and check if any error occurring in the splunkd logs.
import sys
import os
import requests
import json
def test():
data = { 'name':'username', 'password':'password', 'roles':'user'}
response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
response.raise_for_status()
if __name__ == "__main__":
try:
test()
except Exception as e:
print >> sys.stderr, "ERROR Unexpected error: %s" % e
sys.exit(1)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Add exception handling in your script and check if any error occurring in the splunkd logs.
import sys
import os
import requests
import json
def test():
data = { 'name':'username', 'password':'password', 'roles':'user'}
response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
response.raise_for_status()
if __name__ == "__main__":
try:
test()
except Exception as e:
print >> sys.stderr, "ERROR Unexpected error: %s" % e
sys.exit(1)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Search logs in splunkd.log for your alert action, you can use below query.
index=_internal sourcetype=splunkd component=sendmodalert
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):
and return0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Please share configurations created for custom alert action.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for helping me. I use add-on builder. so I did not edit conf files.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You are importing request, it should be requests.
