Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About addOnGuy
addOnGuy
Loves-to-Learn Lots
Member since:
01-22-2024
08-28-2025
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-22-2024 |
Activity Feed
- Posted Splunk addon - getting event parameters on Splunk Dev. 08-28-2025 02:09 PM
- Posted Splunk Add On Builder Built Add On Configuration UI Page on All Apps and Add-ons. 07-30-2025 06:39 PM
- Posted Re: Add-ons generated with version 4.3.0 of the add-on builder are failing to validate due to an outdated splunk python on Splunk Dev. 04-22-2025 08:27 AM
- Posted Add-ons generated with version 4.3.0 of the add-on builder are failing to validate due to an outdated splunk python sdk on Splunk Dev. 04-21-2025 07:57 PM
- Posted Add-On Builder Alert Action Alert Description on Splunk Dev. 01-22-2024 01:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-28-2025
02:09 PM
I have a Splunk Add-on built to fetch events/alerts. I am currently getting fields for the alerts in the following way: event["server_host"] = helper.settings.get("server_host") event["alert_title"] = helper.settings.get("search_name") event["alert_description"] = helper.settings.get("configuration").get("alert_description") I need to get additional fields such as: Search String, Trigger Time, and Runbook. Is it documented anywhere, or do any of you know what the backend names for these fields are or how to get them? Appreciate any help 🙂
... View more
Labels
- Labels:
-
development
07-30-2025
06:39 PM
The "configuration" page that the Add On Builder has created for my add on isn't matching the additional parameters that I've added for my alert action. Instead, the configuration page seems to somehow show the parameters I used for a prior version. I've checked the global config json file and everywhere else I could think of and they all reflect the parameters for the new version. Despite that, the UI still shows the old parameters. Does anyone have any idea why or where else I could check?
... View more
Labels
- Labels:
-
configuration
-
development
04-22-2025
08:27 AM
I'm now using version 4.4.1 of the Add-On Builder, and that seems to have helped slightly. I'm still getting the same failure, but at least now it says I'm using version 2.0.1 of the python SDK. It requires version 2.0.2 though. I'm still completely lost as to how to satisfy the validator. Is anyone able to make it past this one? Here's the error output: [{"result": "failure", "message": "Detected an outdated version of the Splunk SDK for Python (2.0.1). Upgrade to 2.0.2 or later. File: bin/splunklib/__init__.py Line Number: 33", "message_filename": "bin/splunklib/__init__.py", "message_line": 33}, {"result": "warning", "message": "Splunk SDK for Python detected (version 2.1.0). No action required at this time. File: bin/ta_ignio_integration_add_on/aob_py3/splunklib/__init__.py Line Number: 33", "message_filename": "bin/ta_ignio_integration_add_on/aob_py3/splunklib/__init__.py", "message_line": 33}] I'm also getting this validation error: [{"result": "failure", "message": "Found AArch64-incompatible binary file. Remove or rebuild the file to be AArch64-compatible. File: bin/ta_ignio_integration_add_on/aob_py3/yaml/_yaml.cpython-37m-x86_64-linux-gnu.so File: bin/ta_ignio_integration_add_on/aob_py3/yaml/_yaml.cpython-37m-x86_64-linux-gnu.so", "message_filename": "bin/ta_ignio_integration_add_on/aob_py3/yaml/_yaml.cpython-37m-x86_64-linux-gnu.so", "message_line": null}, {"result": "failure", "message": "Found AArch64-incompatible binary file. Remove or rebuild the file to be AArch64-compatible. File: bin/ta_ignio_integration_add_on/aob_py3/markupsafe/_speedups.cpython-37m-x86_64-linux-gnu.so File: bin/ta_ignio_integration_add_on/aob_py3/markupsafe/_speedups.cpython-37m-x86_64-linux-gnu.so", "message_filename": "bin/ta_ignio_integration_add_on/aob_py3/markupsafe/_speedups.cpython-37m-x86_64-linux-gnu.so", "message_line": null}] Unfortunately, the Add-On Builder doesn't mention how to actually fix either issue, so I'm stuck for now. You mentioned using -t to target the pip install, but I'm not sure where I would be targeting.
... View more
04-21-2025
07:57 PM
I first tried exporting and importing the add-on after I moved to version 4.3.0 of the add-on builder. I then tried replacing the splunklib folders in the add-on builder and the app that is failing validation with one from the latest sdk release. I also used "pip install splunk-sdk" and "python setup.py install" to attempt to update the sdk. None of the changes seem to have had any effect.
... View more
01-22-2024
01:17 PM
I've been searching for awhile, but I haven't been able to find how to access an alert's description from within my add-on's alert action Python code. I'm using helper.get_events() to get the alert's triggered events and helper.settings to get the title of the alert. Both are from https://docs.splunk.com/Documentation/AddonBuilder/4.1.4/UserGuide/PythonHelperFunctions. That documentation page doesn't seem to list any way to pull an alert's description though. Does anyone know where it's stored/how to access it?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-28-2025
12:43 PM
|
