Run Script Alert

[arun_kant_sharm]

How to run a script with a alert action?
Example I want to disable a Splunk App if the daily license usage is more than 80%, but when I try to run script on that alert it shows that message "
The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead.
"
Please guide what is the proper way to do it.

[harsmarvania57]

Hi,

"Run a script" alert action is deprecated, you need to move to new framework called "Custom Alert Action". Have a look at document https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsIntro and you'll get idea.

[arun_kant_sharm]

I am using below search string:

source=*license_usage.log type="RolloverSummary" earliest=@d | stats sum(b) AS used max(stacksz) AS quota by _time | eval usedGB=round(used/1024/1024/1024,3) | eval quotaGB=round(quota/1024/1024/1024,3) | eval percentage=round(usedGB / quotaGB, 3)*100 | table _time usedGB, quotaGB, percentage, used, quota | where percentage > 80

What is the right way to trigger script with a alert ?