Alerting

errors in custom alert action

damucka
Builder

Hello,

We created a custom alert action as per documentation and try to trigger it.
We get the following errors:

2/19/20
4:01:42.547 PM  
02-19-2020 16:01:42.547 +0100 ERROR SearchScheduler - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found., search='sendalert splunk2alc results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760/results.csv.gz" results_link="https://splunk-ml.zone1.mo.sap.corp:443/app/mlbso/@go?sid=scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760"'
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found.
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - action=splunk2alc - Failed to find alert.execute.cmd "python".
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.544 PM  
02-19-2020 16:01:42.544 +0100 INFO  sendmodalert - Invoking modular alert action=splunk2alc for search="Crash Dump Alert ALC - AlertAction" sid="scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760" in app="mlbso" owner="d038423" type="saved"
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:38.316 PM  
02-19-2020 16:01:38.316 +0100 DEBUG sendmodalert - action=alert_manager - Token value action.splunk2alc=1

Our alect_actions.conf looks as follows:

[splunk2alc]
is_custom = 1
disabled = 0
label = Splunk2ALC
description = Send Alert to Alc
track_alert = 1
ttl         = 600
maxtime     = 5m
icon_path = alert_manager_icon.png
payload_format = xml
alert.execute.cmd = python
alert.execute.cmd.arg.0 = /opt/splunk/etc/apps/mlbso/bin/splunk2alc.py

under the alert.execute.cmd we have tried already quite some combinations, like:

$SPLUNK_HOME$/bin/python
$SPLUNK_HOME/bin/python
/opt/splunk/bin/python

All throw same error.

Any ideas?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml

View solution in original post

0 Karma

manjunathmeti
Champion

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...