Alerting

Difference between script alert action and custom alert action

rhobby
New Member

What is exactly the difference between a script alert action and a custom alert action?

On http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/ConfiguringScriptedAlerts I can read that script alert action are deprecated.

If I have a script alert action. What ist the way to create a custom alert action?

Best wishes,

Robert

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

Scripted alerts, now deprecated, were alerts that triggered scripts to run. Custom alert actions have replaced them and can do the same and more, with a better user experience. If you have a scripted alert that you want to convert, try following these docs to create an alert action using the script you already have. http://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/ModAlertsIntro

View solution in original post

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Scripted alerts, now deprecated, were alerts that triggered scripts to run. Custom alert actions have replaced them and can do the same and more, with a better user experience. If you have a scripted alert that you want to convert, try following these docs to create an alert action using the script you already have. http://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/ModAlertsIntro

0 Karma

rhobby
New Member

Thank you for your answer.

I tried to follow these steps. I have a script that tries to fetch the environment variables SPLUNK_ARG_X.

In the custom alert action they seem to be nonexistent. Unfortunately in the link, provided by you, is no mention of these variables.

Is it still possible to use these variables?

0 Karma

oddsve
New Member

It is documented in the following page here: http://docs.splunk.com/Documentation/Splunk/6.6.3/AdvancedDev/CustomAlertConvertScripted

"For custom alert actions, use configuration file parameters to access and pass values to the configuration payload that the alert action receives."
Meaning you can't use SPLUNK_ARG_X arguments, these need to be called upon from a configuration file.

0 Karma

jef152
Explorer

I'm also looking for how to get the environment variables into my alert action script. Has anyone had success with this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...