topic Re: Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script in Splunk Enterprise

Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

Salvador_Dalí — Wed, 23 Jul 2025 03:56:41 GMT

I don't understand why the legacy 'run a script' alert action has been deprecated. The official guidelines to create a 'Custom Alert Action' are to complicated to follow.

I attempted to find a guide from Google, but there are too many conflicting methods, and I consistently failed to implement them.

I just want a simple and straightforward guide to create a 'Custom Alert Action' that runs a batch file (script.bat) or a PowerShell script file (script.ps1) when the alert is triggered.

Or just create a 'custom alert action' that exactly do the same thing as the deprecated 'run a script' alert action. (Just type the batch file name and that's it)

Environment: Splunk Enterprise 9.1 (Windows)

Re: Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

PrewinThomas — Wed, 23 Jul 2025 04:05:13 GMT

@Salvador_Dalí

The run a script alert action is officially deprecated.
You can better try with a custom alert action app.

Create custom alert action app with bin, default, and metadata folders
Eg:
$SPLUNK_HOME/etc/apps/custom_alert_action/bin/
Put your script.bat inside the bin/ folder

Inside default/, create alert_actions.conf

[run_script] is_custom = 1 label = Run Script description = Executes a script script = script.bat

Also in default/, create app.conf

[install] state = enabled [ui] is_visible = true

Restart Splunk
After restarting, your alert action “Run Script” will show up in the alert UI

#https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/configure-alert-actions/run-a-script-alert-action

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

Salvador_Dalí — Wed, 23 Jul 2025 06:19:45 GMT

Didn't work. The alert is triggered but the batch didn't run.

Re: Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

livehybrid — Wed, 23 Jul 2025 06:36:57 GMT

Hi @Salvador_Dalí

To create a simple custom alert action that runs a batch file (script.bat) or PowerShell script (script.ps1) on Windows in Splunk Enterprise 9.x, you'll need to build a basic Splunk app with a custom modular alert. This replaces the deprecated "run a script" action.

Create a new app directory on your Splunk server, navigate to $SPLUNK_HOME/etc/apps/ and create a new folder, e.g., myorg_custom_action.

Create default/alert_actions.conf with:

[my_script_action]
is_custom = 1
label = Run My Script
description = Runs a batch or PowerShell script
payload_format = json

Create default/app.conf with basic app metadata:

[ui]
is_visible = 0  
# Hide from app list because this isnt a UI based app...

#... etc.

Create bin/my_script_action.py (the Python script that executes your batch/PS script). Use this template to get you started:

python
     import sys
     import json
     import subprocess

     # Read payload from stdin
     payload = json.loads(sys.stdin.read())

     # Define your script path (absolute path on the Splunk server)
     script_path = "C:\\path\\to\\your\\script.bat"  # Or .ps1 for PowerShell

     # Run the script (use powershell.exe for .ps1)
     if script_path.endswith('.ps1'):
         subprocess.call(['powershell.exe', '-File', script_path])
     else:
         subprocess.call([script_path])

     sys.exit(0)

If you want to pass alert data to the script, modify the Python to write payload to a file or pass as args, then adjust your batch/PS script accordingly.
Restart Splunk ($SPLUNK_HOME/bin/splunk restart). The action "Run My Script" will appear in alert configuration under "Add Actions".
Test: Create a test alert, add your custom action, and trigger it to verify the script runs.

This is a minimal setup, I would recommend extending it for error handling or parameters as required.

Custom alert actions are modular apps that allow flexible scripting. The Python handler example reads the alert payload and executes your external script using subprocess. This works on Windows but ensure the Splunk service account has permissions to run the scripts.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

Salvador_Dalí — Wed, 23 Jul 2025 07:17:13 GMT

It didn't work. The alert is triggered but the batch still didn't run.