Is it possible to pass additional user-defined arguments to an alert script when an action is triggered?

[vinaymehar]

I understand that Splunk 6.4.1 passes several alert-defined values to a script when an alert action is triggered (http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Configuringscriptedalerts). However, I want to be able to pass in some user-defined parameters as well, in order to distribute the alerts effectively. Normally, I would imagine you could just pass in the arguments where you call upon the script in the alert configuration ("$SPLUNK_HOME/bin/scripts/alert.sh arg1 arg2 arg3"). but I doubt that would work because it looks like the positional arguments are already filled by the alert-defined values.

Is there a way to pass in user-defined values? I tried looking throughout the forums but I'm not getting a concrete answer. I'm leaning toward "No", but wanted to confirm.

[woodcock]

If by user-defined you mean inside the search results, then yes, you can do it like this:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Emailnotification#Use_tokens_in_email_notifi...