DECRYPT2 - Splunk Email Alert

[shadowlu]

Using the DECRYPT2 app, I have a search that uses the decrypt command to decode a encoded string. It returns results as a table just fine. I created a email alert using this search but the email alert fails to trigger unless I remove the decrypted field from the table.  I would like the email alert to be sent which includes the decoded value from the decrypted field. Anyone might know what the issue is? 

[shadowlu]

Yeah I did that and it works for them. In the logs, I see the following error:

03-06-2024 05:05:01.427 -0800 ERROR ScriptRunner [1509543 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunksrver:8000/app/search/@go?sid=scheduler_bHVkQGVjbi5vZW0uZG9lLmdvdg__search__RMD500f838..." "ssname=Test Windows Encode" "graceful=True" "trigger_time=1709730300" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_bHVkQGVjbi5vZW0uZG9lLmdvdg__search__RMD500f838a99e0e9d56_at_1709730300_4407/results.csv.gz" "is_stream_malert=False"':  _csv.Error: line contains NUL

[yuanliu]

Not sure if I understand.  What is "it" and what is "them" for which "it" works?  Again, this is not a search question.  Perhaps better suited for Splunk Dev forum.  It looks like related to some data, perhaps encrypted data. You can read /opt/splunk/etc/apps/search/bin/sendemail.py and its imported modules and diagnose this message.  (_csv is one of those modules.)  But volunteers will not have sufficient information to really pin point.

[yuanliu]

If all you need to get alert going is to remove decrypted field, it could be an undocumented security feature in alert actions.  But it could also be a DECRYPT2 feature.  Ask app developers or consult its documentation.