What indicates this missing parameter failure is this error message in the MS Teams App → Logging Reports → MS Teams - modular action failures menu that contains this:
signature="Error: 'in <string>' requires string as left operand, not NoneType. Please double check spelling and also verify that a compatible version of Splunk_SA_CIM is installed." action_name="ms_teams_publish_to_channel"
The fix appears to be going in to the MS Teams action through the alert interface, and toggling the field ordering dropdown, this adds the missing parameter.
Is there a way to review all the existing alerts in my Splunk Cloud instance, and check for a missing parameter?
From March 3rd onward we kept receiving this message in every MS Teams alert that was sent: "Important: Your connector is running on old configuration. Navigate to connector configuration window to update to new configuration."
So finally I decided to update to version 1.0.19 and now zero messages are being sent. I see this in the log: "file=setup_util.py:log_info:117 | Customized key can not be found"...
Since I couldn't figure out a way to get the name of the scheduled search (for the REST query), I updated all alerts that were missing the parameter by hand, and set the ms_teams_fields_order parameter.
if there is an easier way, or if anyone knows how to get the name of the alert (for REST endpoints, not the alert title), please let me know.