Alerting

cutom alert action python script

pipipipi
Path Finder

Hi all. I am struggling where should I check.

I want to make splunk user automatically.
so, I made this script.

test.py

import sys
import os
import request
import json

def test():

data = { 'name':'username', 'password':'password', 'roles':'user'}


response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))


id __name__ == "__main__":
 test()

I can execute this scripts python test.py in my /home directory,

and I can create user.

so I made custom alert action.

I made an alert and select this custom action, but I can not create user.

I have no idea because there are no error in internal log(splunkd.log).

where should I check???

0 Karma
1 Solution

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

View solution in original post

manjunathmeti
Champion

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

harsmarvania57
Ultra Champion

Search logs in splunkd.log for your alert action, you can use below query.

index=_internal sourcetype=splunkd component=sendmodalert
0 Karma

pipipipi
Path Finder

Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):and return0

0 Karma

manjunathmeti
Champion

Please share configurations created for custom alert action.

0 Karma

pipipipi
Path Finder

Thank you for helping me. I use add-on builder. so I did not edit conf files.

0 Karma

manjunathmeti
Champion

You are importing request, it should be requests.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...