https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257259#M4774 <P>I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.</P> <P>Hence my suspicion that my user is lacking a 'capability'.</P> Sun, 04 Oct 2015 19:04:22 GMT robertlight 2015-10-04T19:04:22Z https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257257#M4772 <P>I cannot run a shell script as part of my alert. It is clear that I need my user to have a particular splunk capability - when I add the "admin" role, I am able to run my shell script, without "admin" role, I get an error saying it can't find search "runshellscript"</P> <P>What splunk "capability" is required to run a shell script??</P> Fri, 02 Oct 2015 19:21:41 GMT https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257257#M4772 robertlight 2015-10-02T19:21:41Z https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257258#M4773 <P>Hi.. I don't think there is a specific capability requirement to allow scripts within alerts. As along as "schedule_search" capability is allowed for the role. The users within that role should be able to setup script for alert actions.<BR /> There is very good documentation for setting up alerts <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/alert/ConfiguringScriptedAlerts">here</A><BR /> Some info on troubleshooting <A href="http://wiki.splunk.com/Community:TroubleshootingAlertScripts">here</A></P> <P>Hope the info resolves your current issue.</P> Fri, 02 Oct 2015 19:53:35 GMT https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257258#M4773 Yasaswy 2015-10-02T19:53:35Z https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257259#M4774 <P>I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.</P> <P>Hence my suspicion that my user is lacking a 'capability'.</P> Sun, 04 Oct 2015 19:04:22 GMT https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257259#M4774 robertlight 2015-10-04T19:04:22Z https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257260#M4775 <P>Ah.. reasonable suspicion. The list of offered capabilities is not that <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Security/Rolesandcapabilities">long</A> .. and nothing seems to jump out pointing to this specific retirement (for me). So if you set any other kind of alert (email for eg).. does it work (without needing admin role)? What are the permissions on the script? </P> Mon, 05 Oct 2015 15:38:39 GMT https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257260#M4775 Yasaswy 2015-10-05T15:38:39Z https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257261#M4776 <P>The capability "edit_scripted" is required to use the "runshellscript"</P> <P>I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.</P> Wed, 07 Oct 2015 16:06:57 GMT https://community.splunk.com/t5/Alerting/What-capability-is-required-to-be-able-to-execute-a-shell-script/m-p/257261#M4776 robertlight 2015-10-07T16:06:57Z