Send a message to a webhook through a script alert

[Tomlou]

The script I've completed is as follows

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import sys
import json
import requests

DINGTALK_WEBHOOK = "https:***"

def send_dingtalk_alert(computer_name, event_id, message):
headers = {"Content-Type": "application/json"}
markdown_text = f"""## Splunk alert
**computer_name**: {computer_name}
**event_id**: {event_id}
**message**: {message}"""

data = {
"msgtype": "markdown",
"markdown": {
"title": "Windows alert",
"text": markdown_text
},
"at": {
"isAtAll": False
}
}

try:
response = requests.post(
DINGTALK_WEBHOOK,
data=json.dumps(data),
headers=headers,
timeout=10
)
if response.json().get("errcode") != 0:
print(f"error: {response.text}")
return False
return True
except Exception as e:
print(f"error: {str(e)}")
return False

if __name__ == "__main__":
try:
computer_name = sys.argv[1]
event_id = sys.argv[2]
event_message = sys.argv[3]
except IndexError:
print("Error: Necessary parameters are missing")
print("Usage: script.py <ComputerName> <EventCode> <Message>")
sys.exit(1)

success = send_dingtalk_alert(computer_name, event_id, event_message)

if not success:
sys.exit(2)

But the content of the alert I received is incorrect, and the alert content is what I filtered from the logs, as follows ：
Splunk Alert Notifications
Alarm Event ID: Type=Error ComputerName=RJSER-FILESERIT.abc.com EventCode=* _time=*
Alarm event content: Type=Error ComputerName=RJSER-FILESERIT.abc.com EventCode=* _time=*

How can I modify the script to obtain the correct data?

[livehybrid]

Hi @Tomlou 

I dont think you can read in the arguments in that way when running as a modinput, I'd recommend checking out https://docs.splunk.com/Documentation/Splunk/9.4.1/AdvancedDev/ModInputsExample which has a working example that you can tweak. 

You could also look at the following example by @LukeMurphey https://github.com/LukeMurphey/splunk-modular-alert-example/blob/master/src/bin/make_a_log_message.p... which could also get you started!

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing