Does Slack Notification Alert app work with Splunk Cloud?

[andyscoggins]

I had the Slack Notification Alert app installed in my instance of Splunk Cloud by the support team, as they require. I added the Webhook URL in Setup Slack Alerts.

When I run sendalert manually the message shows up in #mychannel:

search blahblahblah | sendalert slack param.channel="#mychannel" param.message="Found blahblahblah"

I set up a scheduled alert, added Slack as an action, and added #mychannel, but I never get the message and these errors are in splunkd.log (sensitive info removed):

04-04-2018 17:00:03.252 +0000 ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 5., search='sendalert slack results_file="REMOVED" results_link="REMOVED"'

04-04-2018 17:00:03.247 +0000 WARN sendmodalert - action=slack - Alert action script returned error code=5

04-04-2018 17:00:03.245 +0000 FATAL sendmodalert - action=slack STDERR - Invalid webhook URL specified. The URL must use HTTPS.

Any ideas on what may be causing the problem?

Thanks for any help.

[Azeemering · Accepted solution]

No this is not compatible on Splunk Cloud (yet)
This version is not yet available for Splunk Cloud.

See: https://splunkbase.splunk.com/app/2878/#/details

[leonards1]

Confused here..... Splunkbase shows this as compatible and I have had this running successfully on Splunk Cloud for the past year or so. We are currently at v1.0.1, although I notice that Splunkbase shows a v2.0.3 available.

[andyscoggins]

That's interesting. I couldn't get v1.0.1 to work at all. I found a workaround, but may do more investigating if it's working for others.

[andyscoggins]

Thank you for confirming.

It seems that most of the things that I want to do aren't compatible with Splunk Cloud.

[ziegfried]

Version 1.1.0 should be cloud compatible.

[ziegfried]

I assume this is version 1.1.0 of the app?

You could try to increase the logger level for alert actions temporarily to see more information in the logs:

Navigate to "Settings" -> "Server settings" -> "Server logging"
Search for the log channel "sendmodalert"
Select logging level "DEBUG"
NOTE: This will increase cause detailed logs to be produced for all alert actions and might have an
inpact on system performance. It is not recommended to do this on a production system.

[andyscoggins]

Thanks, but Splunk Cloud doesn't allow this level of debugging.