Alerting

cutom alert action python script

Path Finder

Hi all. I am struggling where should I check.

I want to make splunk user automatically.
so, I made this script.

test.py

import sys
import os
import request
import json

def test():

data = { 'name':'username', 'password':'password', 'roles':'user'}


response = request.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))


id __name__ == "__main__":
 test()

I can execute this scripts python test.py in my /home directory,

and I can create user.

so I made custom alert action.

I made an alert and select this custom action, but I can not create user.

I have no idea because there are no error in internal log(splunkd.log).

where should I check???

0 Karma
1 Solution

Influencer

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

View solution in original post

Influencer

Add exception handling in your script and check if any error occurring in the splunkd logs.

 import sys
 import os
 import requests
 import json

 def test():
    data = { 'name':'username', 'password':'password', 'roles':'user'}
    response = requests.post('https://mng_uri:8089/services/authentication/users', data=data, auth=('admin','passme'))
    response.raise_for_status()

 if __name__ == "__main__":
    try:
        test()
    except Exception as e:
        print >> sys.stderr, "ERROR Unexpected error: %s" % e
        sys.exit(1)

View solution in original post

SplunkTrust
SplunkTrust

Search logs in splunkd.log for your alert action, you can use below query.

index=_internal sourcetype=splunkd component=sendmodalert
0 Karma

Path Finder

Thank you. but exit code =0.
I can not understand def process_event(helper, *args, **kwargs):and return0

0 Karma

Influencer

Please share configurations created for custom alert action.

0 Karma

Path Finder

Thank you for helping me. I use add-on builder. so I did not edit conf files.

0 Karma

Influencer

You are importing request, it should be requests.

0 Karma