Alerting

Help with app or alert that is not firing

paries
Explorer

Hello,
I have an app/plugin installed (glips Alerts)
i have modified it slightly to work for our environment.
I can not get it to work with alerts and looking for some help on how to debug it.

i have a couple of debug statements in the glip.py

 sys.stdout = open("c:\\temp\\glip_plugin.log", "w")
 print >> sys.stdout, sys.argv

if i do this in the search

host="PROD-API" | spath Path | search Path="/api/CheckAuth"| spath "LogData.AUTH.Status" | search "LogData.AUTH.Status" != Success | sendalert glip param.webhook_url="https://hooks.glip.com/webhook/xxxxxxxxxxxxxxxxxxxxxxxxxxxx" param.message="$result.LogData.AUTH.Request$" param.title="API CHECKAUTH" param.activity=" Api 2.0 Auth Error Alert" param.uniquelogid="$result.UniqueLogId$"

i get the notice, and in the log file i see that glip.py has been called.

The problem is my alert is not calling it. I see nothing in the glip_plugin.log

The search for the alert is the same as above .

Is it safe to say that since the "sendalert glip" command appears to work that it must be the way i set up the alert?

the alert is set up as
alt text

Any suggestions on how to debug (still a newb at this ) would be great , thanks

Tags (2)
0 Karma
1 Solution

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

View solution in original post

0 Karma

paries
Explorer

Found my issue
It seems like using realtime is problematic Once i change to a cron or every 5 minutes is started working as expected

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...