Description
When triggering an alert action in the Splunk app, if the event does not contain the _time field, the alert action fails with the following error:
Error of type "float() argument must be a string or a number, not 'NoneType'"
This happens because the _time field is used to generate the date of the incident or incident response case, and the current implementation assumes that _time is always present.
Expected Output
The alert action should not fail when _time is missing.
The App should still create the incident / incident response case with a valid timestamp (Generate a timestamp based on the current processing time of the alert)
Description
When triggering an alert action in the Splunk app, if the event does not contain the
_timefield, the alert action fails with the following error:Error of type "float() argument must be a string or a number, not 'NoneType'"This happens because the
_timefield is used to generate the date of the incident or incident response case, and the current implementation assumes that_timeis always present.Expected Output
The alert action should not fail when
_timeis missing.The App should still create the incident / incident response case with a valid timestamp (Generate a timestamp based on the current processing time of the alert)