Newly added Splunk alert action doesn't show in Alert

[wendtb]

I have just added 2 new alert actions in Splunk. I verified that the permissions on the alert action are read for everyone, and the app for that alert action is shared to everything. I am unable to see the alert actions in an alert that is already configured.

The alert actions are being distributed via deployment server to two search heads.

What am I missing?

[wendtb · Accepted solution]

This was resolved with help from the Splunk slack channel.

I had to import the app into ES in order for the alert action to show up for ES alerts. This only applies to ES versions 5.2.2 or before.

Reference Document: https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps

[koshyk]

Are the search heads, standalone search heads? If it is Clustered, then Deployment-server is NOT the method to deploy apps to SHC

if it is standalone Search Heads, please run a btool on the Search Head to see if which app owns the alerts and ensure the permissions are correct in SH

/opt/splunk/bin/splunk cmd btool alert_actions list --debug > /tmp/alert_actions.btool.txt

cheers

[wendtb]

What am I looking for in the alert_actions.conf that tells me which app owns the alerts? I don't see anything specifically referring to ownership.

These are also standalone search heads.

[wendtb]

I also tried direct install of the alert actions/app onto the Search Head, and I am having the same problem.