Using the DECRYPT2 app, I have a search that uses the decrypt command to decode a encoded string. It returns results as a table just fine. I created a email alert using this search but the email alert fails to trigger unless I remove the decrypted field from the table. I would like the email alert to be sent which includes the decoded value from the decrypted field. Anyone might know what the issue is?
Yeah I did that and it works for them. In the logs, I see the following error:
03-06-2024 05:05:01.427 -0800 ERROR ScriptRunner [1509543 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunksrver:8000/app/search/@go?sid=scheduler_bHVkQGVjbi5vZW0uZG9lLmdvdg__search__RMD500f838..." "ssname=Test Windows Encode" "graceful=True" "trigger_time=1709730300" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_bHVkQGVjbi5vZW0uZG9lLmdvdg__search__RMD500f838a99e0e9d56_at_1709730300_4407/results.csv.gz" "is_stream_malert=False"': _csv.Error: line contains NUL
Not sure if I understand. What is "it" and what is "them" for which "it" works? Again, this is not a search question. Perhaps better suited for Splunk Dev forum. It looks like related to some data, perhaps encrypted data. You can read /opt/splunk/etc/apps/search/bin/sendemail.py and its imported modules and diagnose this message. (_csv is one of those modules.) But volunteers will not have sufficient information to really pin point.
If all you need to get alert going is to remove decrypted field, it could be an undocumented security feature in alert actions. But it could also be a DECRYPT2 feature. Ask app developers or consult its documentation.