Alerting

Is the alert script capability for alert actions restricted to the admin user or is there a setting I can change?

pduflot
Path Finder

Hello,

I have a python script as an alert action.
I could not make it work until I changed the owner of the alert to admin. Even when the owner had the admin role, the script was not called.
In the scheduler.log, I see alert_actions="" when the user is not the admin user.
While I see, alert_actions="script" when the user is the admin user.

Is this alert script capability restricted to the admin user or are there any other settings I can change?

Thanks,

0 Karma
1 Solution

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

View solution in original post

0 Karma

pduflot
Path Finder

Sorry I had one conflicted line remaining in the first alarm (alert_condition = search count = 1). User rights had nothing to do with it.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...