Alerting

Error in 'sendalert' command:Alert script returned error code 1., search='sendalertpush_alerts_to_swimlane

Anji_splunk
Loves-to-Learn

Hi!

We are trying to push alerts into Swimlane using the swimlane add-on. But getting error as below:

06-28-2022 04:45:08.234 -0500 ERROR SearchScheduler [4094 AlertNotifierWorker-0] - Error in 'sendalert' command: Alert script returned error code 1., search='sendalert push_alerts_to_swimlane results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_Xghedjhwqklahd"

06-28-2022 04:45:08.234 -0500 WARN sendmodalert [4094 AlertNotifierWorker-0] - action=push_alerts_to_swimlane - Alert action script returned error code=1

 

Swimlane App link: https://splunkbase.splunk.com/app/3708/

 

Any help with this is much appreciated. 

 

Thanks

Labels (1)
0 Karma

Anji_splunk
Loves-to-Learn

Hi @jamie00171 ,

Thank you for your quick response. I am not seeing anything other than scheduler error logs.

Thanks,

Anji

0 Karma

jamie00171
Communicator

hi @Anji_splunk 

There will most likely be a log file for custom alert action provided by the Swimlane app inside the _internal index.

If you look at:

index=_internal | stats values(source)

You'll be able to see all of the log files and there should be one relating to the swimlane alert action that will most likely contain a more useful error message so might be worth having a look there.

Thanks, 

Jamie

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...