Is there any way to display dynamic content in the custom alert action UI?
This is extremely old, but I thought I would give an answer anyway. Please follow this doc to find your answer: http://docs.splunk.com/Documentation/Splunk/6.5.2/AdvancedDev/CustomAlertUI#Dynamic_input_controls
This doesn't seem to work properly. I added custom drilldown(splunk-search-dropdown) to my html, it executes the search query and gives me values in dropdown. But, when I select and save the configuration, it's not reflected in conf file. It never saves the selected dropdown value.
<div class="control-group"> <label class="control-label">Custom Dropdown</label> <div class="controls"> <splunk-search-dropdown name="action.[app_name].param.[param_name]" search="[search query]" value-field="[value_field]" label-field="[label_field]"> </splunk-search-dropdown> </div> </div>
Also, if I add 'splunk-search-dropdown' inside 'splunk-control-group' , the dropdown never shows up.
I have already added param_name in alert_actions.conf
Excuse my super late reply. Below may help those who arrive here after me.
Be careful to check that your html is referencing your stanza name - not your app name.
Below is how to extend the "logger_app" example in docs to add a dropdown. User's choice is sent to script.
<form class="form-horizontal form-complex">
<p>Write log entries for this action.</p>
search=" | inputlookup alert_action_dropdown1.csv | stats c by foo1"
is_custom = 1
disabled = 0
label = Log alert action
description = Custom action for logging fired alerts
icon_path = logger_logo.png
param.mychoice0=This param is hardcoded. Look, I can use a token: $result.host$
#param.mychoice1=This param comes in from your stanza in savedsearches.conf.
#savedsearches.conf: action.logger.param.mychoice1=User picks from the UI. See logger.html
Output in test_modalert.log then looks like:
<param name="mychoice0">This param is hardcoded. Look, I can use a token: </param>