Alerting

Hipchat alerts app: invalid key in stanza

burwell
SplunkTrust
SplunkTrust

I am following the instructions in http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/ModAlertsAdvancedExample using Splunk 6.4.1

I created alert_actions.conf per the documentation and get these errors (changed company name and token value)

Invalid key in stanza [hipchat] in /opt/splunk/etc/apps/hipchat_app/default/alert_actions.conf, line 10: param.base_url    (value:  http://mycompany.hipchat.com/v2).

Invalid key in stanza [hipchat] in /opt/splunk/etc/apps/hipchat_app/default/alert_actions.conf, line 11: param.auth_token  (value:  cyeYO123L5xwzZf2NmEQFD2A1ajm5PQu3O37yIVf).

[hipchat]
is_custom = 1
label = HipChat
description = Send HipChat room notifications
icon_path = hipchat_alert_icon.png
payload_format = json

param.base_url   = https://mycompany.hipchat.com/v2/room/2943772/notification?
param.auth_token = cyeYO123L5xwzZf2NmEQFD2A1ajm5PQu3O37yIVf

If I comment out those two args that are getting errors and then try editing the actions of a saved search
1) I don't see the ability to add a hipchat alert under add actions

2) In manage alert actions I do see the hipchat png .. on this page http://myserver:8000/splunk/en-US/manager/search/alert_actions

So basically I only need the python script and the few other configs, right? I am not sure what is causing the invalid key in stanza error.
I am not using any other Splunkbase apps.

0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

I ended up installing this app https://splunkbase.splunk.com/app/2879/ and that worked for me.

The python script was different from that documented in http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/ModAlertsAdvancedExample

View solution in original post

burwell
SplunkTrust
SplunkTrust

I ended up installing this app https://splunkbase.splunk.com/app/2879/ and that worked for me.

The python script was different from that documented in http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/ModAlertsAdvancedExample

Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...