Strange message for SMS Alert

[qiaojing]

Hi, I'm currently trying to implement SMS Alert for Splunk. I have a SMS Gateway server in my organisation and I'm using it to send SMS alert.

I'm able to receive the SMS but the message was a long strange of nonsensical alphabets.

May I know if there's any formatting of the Splunk Alert that led to this? Or how can I configure the message such that the message sent via SMS is in human readable format.

Any help or idea will be greatly appreciated. Thank you 🙂

[newbie2tech]

@qiaojing did you get this working...if so can you share how

[Jeremiah]

You might want to take a look at this answer:

https://answers.splunk.com/answers/140254/how-to-set-alert-emails-to-send-in-plain-text-in-splunk-6....

We actually saw a similar problem with sending emails directly from Splunk to our pager gateway. Now we aggregate alerts in our event management tool, and send the pages from there.

[acharlieh]

If I had to guess it sounds like a character encoding problem somewhere along the line, whether that's whatever modular alert you're using with Splunk or the SMS Gateway.

[qiaojing]

@woodcook Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it. The server is an internal organisation server.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not check any of the details included in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

[qiaojing]

Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not include any of the details in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

[qiaojing]

@acharlieh Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not include any of the details in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

[woodcock]

Your joking, right? What are the details of your server? How are you alerting to it (slunkbase app, custom command, modular alert)? What are the details here?

[qiaojing]

Hi thanks for your answer. We're suspecting it's some encoding issues as well but not very sure how to solve it. The server is an internal organisation server.

I created a very simple alert base search | stats count by NRIC | where count>0 on Splunk Enterprise.
I did not check any of the details included in the alert eg trigger time/condition. The subject & message is also kept to very simple without the email tokens.

Is there any way to strip all the encoding when splunk passes out the message?

Thank you.

[woodcock]

Are you SENDING an SMS or are you indexing SMS text into Splunk? If the former, how are you doing this (sending SMS is not a native Splunk capability). These are ABSOLUTELY CRITICAL details which you have not shared.