Difference between script alert action and custom alert action

[rhobby]

What is exactly the difference between a script alert action and a custom alert action?

On http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/ConfiguringScriptedAlerts I can read that script alert action are deprecated.

If I have a script alert action. What ist the way to create a custom alert action?

Best wishes,

Robert

[rpille_splunk · Accepted solution]

Scripted alerts, now deprecated, were alerts that triggered scripts to run. Custom alert actions have replaced them and can do the same and more, with a better user experience. If you have a scripted alert that you want to convert, try following these docs to create an alert action using the script you already have. http://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/ModAlertsIntro

[rhobby]

Thank you for your answer.

I tried to follow these steps. I have a script that tries to fetch the environment variables SPLUNK_ARG_X.

In the custom alert action they seem to be nonexistent. Unfortunately in the link, provided by you, is no mention of these variables.

Is it still possible to use these variables?

[oddsve]

It is documented in the following page here: http://docs.splunk.com/Documentation/Splunk/6.6.3/AdvancedDev/CustomAlertConvertScripted

"For custom alert actions, use configuration file parameters to access and pass values to the configuration payload that the alert action receives."
Meaning you can't use SPLUNK_ARG_X arguments, these need to be called upon from a configuration file.

[jef152]

I'm also looking for how to get the environment variables into my alert action script. Has anyone had success with this?