errors in custom alert action

[damucka]

Hello,

We created a custom alert action as per documentation and try to trigger it.
We get the following errors:

2/19/20
4:01:42.547 PM  
02-19-2020 16:01:42.547 +0100 ERROR SearchScheduler - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found., search='sendalert splunk2alc results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760/results.csv.gz" results_link="https://splunk-ml.zone1.mo.sap.corp:443/app/mlbso/@go?sid=scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760"'
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - Error in 'sendalert' command: Alert action script for action "splunk2alc" not found.
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.546 PM  
02-19-2020 16:01:42.546 +0100 ERROR sendmodalert - action=splunk2alc - Failed to find alert.execute.cmd "python".
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:42.544 PM  
02-19-2020 16:01:42.544 +0100 INFO  sendmodalert - Invoking modular alert action=splunk2alc for search="Crash Dump Alert ALC - AlertAction" sid="scheduler__d038423__mlbso__RMD5782cf4a2b848fa26_at_1582124460_1760" in app="mlbso" owner="d038423" type="saved"
host = mo-7ee963859.zone1.mo.sap.corpsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
2/19/20
4:01:38.316 PM  
02-19-2020 16:01:38.316 +0100 DEBUG sendmodalert - action=alert_manager - Token value action.splunk2alc=1

Our alect_actions.conf looks as follows:

[splunk2alc]
is_custom = 1
disabled = 0
label = Splunk2ALC
description = Send Alert to Alc
track_alert = 1
ttl         = 600
maxtime     = 5m
icon_path = alert_manager_icon.png
payload_format = xml
alert.execute.cmd = python
alert.execute.cmd.arg.0 = /opt/splunk/etc/apps/mlbso/bin/splunk2alc.py

under the alert.execute.cmd we have tried already quite some combinations, like:

$SPLUNK_HOME$/bin/python
$SPLUNK_HOME/bin/python
/opt/splunk/bin/python

All throw same error.

Any ideas?

Kind Regards,
Kamil

[manjunathmeti · Accepted solution]

Place python script splunk2alc.py in /opt/splunk/etc/apps/mlbso/bin/ and alert_actions.conf with below configurations in /opt/splunk/etc/apps/mlbso/default.

 [splunk2alc]
 is_custom = 1
 disabled = 0
 label = Splunk2ALC
 description = Send Alert to Alc
 track_alert = 1
 ttl         = 600
 maxtime     = 5m
 icon_path = alert_manager_icon.png
 payload_format = xml