Alerting

errors in custom alert action

damucka
Builder

Hello,

We created a custom alert action as per documentation and try to trigger it.
We get the following errors:

2/19/20
4:01:42.547 PM  
02-19-2020 16:01:42.547 +0100 ERROR SearchScheduler - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found., search='sendalert splunk2alc results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760/results.csv.gz" results_link="https://splunk-ml.zone1.mo.sap.corp:443/app/mlbso/@go?sid=scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760"'
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found.
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - action=splunk2alc - Failed to find alert.execute.cmd "python".
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.544 PM  
02-19-2020 16:01:42.544 +0100 INFO  sendmodalert - Invoking modular alert action=splunk2alc for search="Crash Dump Alert ALC - AlertAction" sid="scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760" in app="mlbso" owner="d038423" type="saved"
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:38.316 PM  
02-19-2020 16:01:38.316 +0100 DEBUG sendmodalert - action=alert_manager - Token value action.splunk2alc=1

Our alect_actions.conf looks as follows:

[splunk2alc]
is_custom = 1
disabled = 0
label = Splunk2ALC
description = Send Alert to Alc
track_alert = 1
ttl         = 600
maxtime     = 5m
icon_path = alert_manager_icon.png
payload_format = xml
alert.execute.cmd = python
alert.execute.cmd.arg.0 = /opt/splunk/etc/apps/mlbso/bin/splunk2alc.py

under the alert.execute.cmd we have tried already quite some combinations, like:

$SPLUNK_HOME$/bin/python
$SPLUNK_HOME/bin/python
/opt/splunk/bin/python

All throw same error.

Any ideas?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml

View solution in original post

0 Karma

manjunathmeti
Champion

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml
0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...