Alerting

errors in custom alert action

damucka
Builder

Hello,

We created a custom alert action as per documentation and try to trigger it.
We get the following errors:

2/19/20
4:01:42.547 PM  
02-19-2020 16:01:42.547 +0100 ERROR SearchScheduler - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found., search='sendalert splunk2alc results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760/results.csv.gz" results_link="https://splunk-ml.zone1.mo.sap.corp:443/app/mlbso/@go?sid=scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760"'
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found.
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - action=splunk2alc - Failed to find alert.execute.cmd "python".
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.544 PM  
02-19-2020 16:01:42.544 +0100 INFO  sendmodalert - Invoking modular alert action=splunk2alc for search="Crash Dump Alert ALC - AlertAction" sid="scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760" in app="mlbso" owner="d038423" type="saved"
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:38.316 PM  
02-19-2020 16:01:38.316 +0100 DEBUG sendmodalert - action=alert_manager - Token value action.splunk2alc=1

Our alect_actions.conf looks as follows:

[splunk2alc]
is_custom = 1
disabled = 0
label = Splunk2ALC
description = Send Alert to Alc
track_alert = 1
ttl         = 600
maxtime     = 5m
icon_path = alert_manager_icon.png
payload_format = xml
alert.execute.cmd = python
alert.execute.cmd.arg.0 = /opt/splunk/etc/apps/mlbso/bin/splunk2alc.py

under the alert.execute.cmd we have tried already quite some combinations, like:

$SPLUNK_HOME$/bin/python
$SPLUNK_HOME/bin/python
/opt/splunk/bin/python

All throw same error.

Any ideas?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...