Is there documentation on the workflow of how Splunk handles scripts on alerts?

[snadams]

Even thought it took me a while, I figured out how to get an alert to run a script. I came across with some problems when I discovered that our Splunk instance runs the script as the search head server that interfered with some of the script functionality. I placed some debugging spots in the script to send out emails of stdout, which works when I run under the system account locally on the box, but not when ran by Splunk.

I was wondering if there was a step-by-step process on how Splunk handles these scripts, so I can figure out where things may be getting hung up.

[aaraneta_splunk]

@snadams - Did the answer provided by hunters help provide a solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[hunters_splunk · Accepted solution]

Hi snadams,

I think you can find some useful information in this doc:
http://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/CustomAlertScript

Hope this helps. Thanks!
Hunter