All Apps and Add-ons

AppInspect tool does not allow action.email.to by default entry in the alerts

eduardKiyko
Explorer

Hello everyone!
Recently i faced an issue with appinspect and email alert action. I got this message:

"Alert name" has specified the `action.email.to` property with a provided value. This should be left empty or removed. File: default/savedsearches.conf Line Number: 50

However, if I put the email into action.email.cc it works, but I need to have an email address in the "to" option(which is kinda weird on my opinion).
In the Splunk dev documentation(https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappins...) it's also mentioned:

Check that email alerts (action.email.to) set in savedsearches.conf do not have a default value.

But my client currently has Splunk Cloud deployment and we want just to put all the alerts into private app for internal usage.
So, it there any way to omit this issue? Because it looks like I cannot upload the private app to the Splunk Cloud having alerts with "email.to" option.

0 Karma

PavelP
Motivator

Hello @eduardKiyko,

your observation is correct, the appinspect checks action.mail.to only and ignores action.mail.cc

@splunk_appinspect.tags("splunk_appinspect", "savedsearches")
@splunk_appinspect.cert_version(min="1.1.8")
def check_for_emails_in_saved_search(app, reporter):
    """Check that email alerts (action.email.to) set in `savedsearches.conf`
    do not have a default value.
    """

    saved_searches = app.get_saved_searches()
    if saved_searches.configuration_file_exists():
        file_path = os.path.join("default", "savedsearches.conf")
        for search in saved_searches.searches():
            for key, value in iteritems(search.args):
                if key == "action.email.to":
                    reporter_output = (
                        "The saved search {} has specified the"
                        " `action.email.to` property with a"
                        " provided value. This should be left"
                        " empty or removed. File: {}, Line: {}."
                    ).format(search.name, file_path, value[1])
                    if value:
                        reporter.fail(reporter_output, file_path, value[1])
    else:
        reporter_output = "No savedsearches.conf exists."
        reporter.not_applicable(reporter_output)

you can remove action.mail.to to pass the appinspect and find a way to use it in local/savesearches.conf

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...