All Apps and Add-ons

AppInspect tool does not allow action.email.to by default entry in the alerts

eduardKiyko
Explorer

Hello everyone!
Recently i faced an issue with appinspect and email alert action. I got this message:

"Alert name" has specified the `action.email.to` property with a provided value. This should be left empty or removed. File: default/savedsearches.conf Line Number: 50

However, if I put the email into action.email.cc it works, but I need to have an email address in the "to" option(which is kinda weird on my opinion).
In the Splunk dev documentation(https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappins...) it's also mentioned:

Check that email alerts (action.email.to) set in savedsearches.conf do not have a default value.

But my client currently has Splunk Cloud deployment and we want just to put all the alerts into private app for internal usage.
So, it there any way to omit this issue? Because it looks like I cannot upload the private app to the Splunk Cloud having alerts with "email.to" option.

0 Karma

PavelP
Motivator

Hello @eduardKiyko,

your observation is correct, the appinspect checks action.mail.to only and ignores action.mail.cc

@splunk_appinspect.tags("splunk_appinspect", "savedsearches")
@splunk_appinspect.cert_version(min="1.1.8")
def check_for_emails_in_saved_search(app, reporter):
    """Check that email alerts (action.email.to) set in `savedsearches.conf`
    do not have a default value.
    """

    saved_searches = app.get_saved_searches()
    if saved_searches.configuration_file_exists():
        file_path = os.path.join("default", "savedsearches.conf")
        for search in saved_searches.searches():
            for key, value in iteritems(search.args):
                if key == "action.email.to":
                    reporter_output = (
                        "The saved search {} has specified the"
                        " `action.email.to` property with a"
                        " provided value. This should be left"
                        " empty or removed. File: {}, Line: {}."
                    ).format(search.name, file_path, value[1])
                    if value:
                        reporter.fail(reporter_output, file_path, value[1])
    else:
        reporter_output = "No savedsearches.conf exists."
        reporter.not_applicable(reporter_output)

you can remove action.mail.to to pass the appinspect and find a way to use it in local/savesearches.conf

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...