3.x: blank "attachment" setting is treated as "none", silently dropping the alert card that 2.2.0 showed

Open Beginner friendly
  • Is something wrong?
#74 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
backend

Research direction

The default is set in _build_config() in package/bin/slack_logic.py, around line 54, and the three attachment branches are in process_event(). Compare how a blank value is handled there against the 2.2.0 behaviour described in the issue. Done means blank, unset, none, alert_link and message produce the same Slack payload as 2.2.0, and any existing tests for that module still pass.

Written by the indexing model from the issue text.

Description

Describe the bug
_build_config() in package/bin/slack_logic.py (line 54 on main):

"attachment": helper.get_param("attachment") or "none",

Alerts saved through the UI often end up with a blank value (action.slack.param.attachment =).

  • 2.2.0: a blank value is not "none", because config.get('attachment', 'none') != 'none'. So the message includes the attachment card: the :bell: <search name> title linking to the alert, Show results in Splunk, and the footer.
  • 3.x: or "none" turns a blank value into "none", so the same alert posts plain text with no links. Nothing is logged, so the change goes unnoticed until someone looks at the channel.

To Reproduce

  1. On 2.2.0, create a Slack alert with action.slack.param.attachment = (blank) and a message. Trigger it: the message shows the alert card with links.
  2. Upgrade to 3.1.0 or 3.1.1 and trigger the same alert.
  3. The message is now plain text, with no title link, "Show results in Splunk" link or footer.

Expected behavior
Same output as 2.2.0. Only an unset attachment should mean "none".

Suggested fix (running on our test search head cluster)

attachment_param = helper.get_param("attachment")
attachment = "none" if attachment_param is None else attachment_param

With this, the three attachment checks in 3.x behave the same as 2.2.0's. We ran the real 2.2.0 slack.py and the patched 3.1.0 process_event() side by side, with network calls stubbed, against the same first result. The Slack JSON was byte-identical for attachment set to none, alert_link, message, blank, unset and an invalid value.

Splunk Environment:

  • Splunk Version: 9.4.13
  • OS: Linux
  • Cloud: no (self-hosted search head cluster)
  • App version: 3.1.0; the code is unchanged in 3.1.1

Additional context
First reported in discussion #72. Two other differences from 2.2.0 that we noticed may be intentional, but neither is in the changelog:

  • multivalue fields in the fields attachment now show all values; 2.2.0 showed only the first;
  • fields = * now also lists the internal __mv_<field> columns and rid.

Happy to open a PR.

Dominant language
Python
Stars
21
Forks
16
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/slack-alerts

All issues in splunk/slack-alerts

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.