I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?

NakatsuKinichi — Sun, 15 Mar 2020 22:33:11 GMT

The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead. Learn more
https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

Re: I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?

manjunathmeti — Mon, 16 Mar 2020 07:49:00 GMT

Hi @NakatsuKinichi,

Check my answer here to create a custom alert action with a script: https://answers.splunk.com/answers/810829/problem-with-scripted-alert.html#answer-810832

Once you create custom alert action configure alert with custom action, select Trigger condition as custom and set condition something like:

| where log_keyword <>= "match_value_ or_count"

| where some conditional logic on log_keyword field values.

For more simplicity you can add conditional logic on log_keyword field values in the alert query itself and set Trigger condition to trigger when number of results is greater than 0.

topic Re: I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword? in Getting Data In

I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?

Re: I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?