Custom alert action is not working as expected.

[knalla]

Hello,

I'm trying to create to custom alert action from alert manager app to automate emails with invoking action. I add this on alert_action.conf. Its not working as expected. Any suggestions?

[snow_email]
is_custom = 1
label = SNOW action
disabled = 0
command = |sendalert sendemail "to=test@service.now.com" "server=relay.test.com" "from=splunk@test.com" "subject=test22"

[sduff_splunk]

I dont think you need the |sendalert at the start of the command, the sendemail should be sufficient

[knalla]

I tried, its working with regular alerts, but not from the app actions.