I had the Slack Notification Alert app installed in my instance of Splunk Cloud by the support team, as they require. I added the Webhook URL in Setup Slack Alerts.
When I run sendalert manually the message shows up in #mychannel:
search blahblahblah | sendalert slack param.channel="#mychannel" param.message="Found blahblahblah"
I set up a scheduled alert, added Slack as an action, and added #mychannel, but I never get the message and these errors are in splunkd.log (sensitive info removed):
04-04-2018 17:00:03.252 +0000 ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 5., search='sendalert slack results_file="REMOVED" results_link="REMOVED"'
04-04-2018 17:00:03.247 +0000 WARN sendmodalert - action=slack - Alert action script returned error code=5
04-04-2018 17:00:03.245 +0000 FATAL sendmodalert - action=slack STDERR - Invalid webhook URL specified. The URL must use HTTPS.
Any ideas on what may be causing the problem?
Thanks for any help.
No this is not compatible on Splunk Cloud (yet)
This version is not yet available for Splunk Cloud.
No this is not compatible on Splunk Cloud (yet)
This version is not yet available for Splunk Cloud.
Confused here..... Splunkbase shows this as compatible and I have had this running successfully on Splunk Cloud for the past year or so. We are currently at v1.0.1, although I notice that Splunkbase shows a v2.0.3 available.
That's interesting. I couldn't get v1.0.1 to work at all. I found a workaround, but may do more investigating if it's working for others.
Thank you for confirming.
It seems that most of the things that I want to do aren't compatible with Splunk Cloud.
Version 1.1.0 should be cloud compatible.
I assume this is version 1.1.0 of the app?
You could try to increase the logger level for alert actions temporarily to see more information in the logs:
Navigate to "Settings" -> "Server settings" -> "Server logging"
Search for the log channel "sendmodalert"
Select logging level "DEBUG"
NOTE: This will increase cause detailed logs to be produced for all alert actions and might have an
inpact on system performance. It is not recommended to do this on a production system.
Thanks, but Splunk Cloud doesn't allow this level of debugging.