From ba8eafce8d98a0e2077881594af83694217a1671 Mon Sep 17 00:00:00 2001
From: Tal <tal@keephq.dev>
Date: Mon, 22 Jul 2024 10:44:02 +0300
Subject: [PATCH] chore(api): add logs to splunk provider when parsing _raw
 (#1434)

---
 keep/providers/splunk_provider/splunk_provider.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/keep/providers/splunk_provider/splunk_provider.py b/keep/providers/splunk_provider/splunk_provider.py
index 41c219310..d0b6c6db0 100644
--- a/keep/providers/splunk_provider/splunk_provider.py
+++ b/keep/providers/splunk_provider/splunk_provider.py
@@ -156,7 +156,12 @@ def _format_alert(
         try:
             raw: str = event.get("_raw", "{}")
             raw_dict: dict = json.loads(raw)
-        except Exception:
+        except Exception as e:
+            logger = logging.getLogger(__name__)
+            logger.warning(
+                "Error parsing _raw attribute from event",
+                extra={"err": e, "_raw": event.get("_raw")},
+            )
             raw_dict = {}
 
         # export k8s specifics