All Apps and Add-ons

Splunk - Add-on builder - cant execute webhooks

jtlittle
Path Finder

anyone know why I cant execute filesystem commands in the app builder with python and slack web hooks?

https://splunkbase.splunk.com/app/2962/
user log 1:

2018-03-07 18:34:42,033 ERROR pid=24690 tid=MainThread file=cim_actions.py:message:271 | sendmodaction - signature="Error: 'module' object has no attribute 'process_event'. Please double check spelling and also verify that a compatible version of Splunk_SA_CIM is installed." action_name="test_alert" search_name="test_arf" sid="1520447680.116" rid="0" app="TA-fancydudeapp" user="admin" action_mode="adhoc" action_status="failure"

log 2:

The os module/method can be used to execute filesystem commands.

Labels (1)
1 Solution

starcher
SplunkTrust
SplunkTrust

Make sure for every gui parameter you have a line in the default alert_actions.conf

[test_alert]
param.process_event = 

View solution in original post

0 Karma

jtlittle
Path Finder

ok so the add-on builder does not do this for you?

support has me using this

https://splunkbase.splunk.com/app/2962/

I can check the alert_actions.conf

I think ill need to SSH to it and use nano cause I don't recall that ability in the app.

thanks for your recomendation ill try that.

-Jon

0 Karma

starcher
SplunkTrust
SplunkTrust

Make sure for every gui parameter you have a line in the default alert_actions.conf

[test_alert]
param.process_event = 

View solution in original post

0 Karma

jtlittle
Path Finder

I tired this :

param.process_event="red_alert"

this is set as the alert action or the app name?

0 Karma

dijikul
Communicator

Can you expand on this? I'm encountering the same issue and adding the process_event parameter does nothing..

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.