Splunk is unable to create BMC Remedy Incidents when alert has trigger condition as Number of results being equal to 0 - Error: "action=remedy_incident STDERR - FileNotFoundError: [Errno 2] No such file or directory:

Applicability

Splunk Cloud Splunk Enterprise

Description

When Splunk has alerts SPL generating 0 results and alerts having trigger condition as NUMBER OF ALERT = 0 to trigger alert action, the BMC Remedy Incident does NOT get created via BMC remedy Incident integration (selected in ALERT ACTION) as this is generally a use-case basis scenario (even in other add-ons). The Resolution explains a way to set such alert with use case of 0 results for a Alert SPL to create BMC Remedy Incident.

Please refer to this doc to set alert with BMC remedy integration and refer to this link for BMC remedy side requirements and process for incidents setup.

Investigation

In a Splunk environment, create an alert with an SPL and set trigger condition as NUMBER OF RESULTS being equal to 0. In the trigger action, select the following two actions:

1) Send Email
2) BMC Remedy Incident Integration

A sample of such alert is as shown below:



Whenever the trigger conditions are satisfied for this alert, email is triggered however it fails to create an incident in ServiceNOW. splunk_ta_snow_ticket.log file shows the following error:

Error: "action=remedy_incident STDERR - FileNotFoundError: [Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/dispatch/scheduler_c3BsdW5rX3RhX2FjdGlvbl9vd25lcg_Qk5DXzY5MTM__RMD521df82d815c23aa5_at_1667937420_957/results.srs.zst'"

Given that the Email is triggered when the trigger conditions are satisfied, it confirms that the alert is working. To make the number of results=0 work in the BMC Remedy INTEGRATION alert actions, a particular parameter is defined in the alert configuration as mentioned in the resolution section.

Resolution

The BMC Remedy incident integration does not honour the alert trigger conditions for number of results=0 hence following steps provides a way to setup alerts that require BMC remedy Incidents created when the SPL returns 0 results.

a) Add/append below to the current search query:

| stats count

b) In the Trigger condition, instead of number of results, please select Custom and add the following in the text box for trigger condition as highlighted in the sample screenshot below:

search count=0

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release