Passing search results to a python script in alert_actions

[fabrizioalleva]

Hi all,

I'm trying to execute a script in a scheduled Alerts, when results of a search are greater than 0.

I've created my $SPLUNK_HOME/etc/apps/[myapp]/default/alert_actions.conf, following:

https://dev.splunk.com/enterprise/docs/devtools/customalertactions/configappcaa

and I've this:

[MyAction]
is_custom = 1
label = MyAction
description = open ticket
payload_format = json
python.version = python3

alert.execute.cmd = test.py

param.datemod =
param.devname =
param.toner =

I've put 3 params in the same file, and everything I write after = generates this error:

Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 9: param.datemod (value: ).
Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 10: param.devname (value: ).
Invalid key in stanza [MyAction] in /splunk/sh/etc/apps/monitor/default/alert_actions.conf, line 11: param.toner (value: ).

I understood that it's waiting for something after the =, I've tried  ( datemod, devname, toner that are the output of the search ) but nothing.

I configured the web gui alert with MyAction as Trigger Action ( the action is now running every 2 minutes ). 

The script is executed, because I write a static line into a file, and I see that the file is always update.

But how can I pass the search results to the script ?

Reading the guide it's no so clear for me.

Thanks in advance for any help!

Fabrizio

[livehybrid]

Hi @fabrizioalleva 

I dont think those errors should cause it not to work, they are reporting as errors because there is no corresponding spec file update for your custom alert action. Have a look at https://github.com/splunk/itsi-deep-dive-email-alert/blob/master/README/alert_actions.conf.spec - basically you need to create a README/alert_actions.conf.spec in your app with something like this:

[MyAction]
param.datemod = <string>
param.devname = <string>
param.toner = <string>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[fabrizioalleva · Accepted solution]

thank for your help!

I've found that I've to configure alert_actions.conf.spec file in README dir of my own application.

After some attempts all is wortking fine