Run Script Alert

[arun_kant_sharm]

How to run a script with a alert action?
Example I want to disable a Splunk App if the daily license usage is more than 80%, but when I try to run script on that alert it shows that message "
The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead.
"
Please guide what is the proper way to do it.

[dimmitrisd]

I recently spent quite some time testing the Run a script alert action in Splunk Enterprise on Windows and wanted to share the result, since there seems to be some confusion around how it works.

Details on my Environment:

• Splunk Enterprise 10.4.1
• Build: 5a009d941268
• Windows
• Python 3.13

The alert was a scheduled alert with the Run a script action, where the configuration only requires the script filename.

The important discovery was that Splunk does not need to pass the actual search results as command-line parameters.

When Splunk executes the script, it provides the documented SPLUNK_ARG_* environment variables. In particular:

• SPLUNK_ARG_0 → script name
• SPLUNK_ARG_1 → number of results
• SPLUNK_ARG_2 → search terms
• SPLUNK_ARG_3 → query
• SPLUNK_ARG_4 → saved search name
• SPLUNK_ARG_5 → trigger reason
• SPLUNK_ARG_6 → saved search URL
• SPLUNK_ARG_7 → deprecated/empty
• SPLUNK_ARG_8 → path to the search results file

The key was SPLUNK_ARG_8.

It points to a file similar to:

C:\Program Files\Splunk\var\run\splunk\dispatch\...\results.csv.gz

The file is gzip-compressed CSV.

A BAT wrapper can pass that path to Python, and Python can then decompress and parse the results.

Just to inform you that after many attempts, I  finally successfully tested the complete chain:

Scheduled Alert

↓

Run a Script

↓

BAT

↓

SPLUNK_ARG_8

↓

results.csv.gz

↓

Python

↓

CSV parsing

↓

Actual alert results

So, yes — the Run a Script alert action works on Windows with Splunk Enterprise 10.4.1, and it is possible to reliably consume the actual search results from the script.

One important caveat: Splunk 10.4.1 displays a warning that Run a script is deprecated and recommends using a custom alert action for new implementations, however “Run a Script” Alert Action Actually Work on Windows fine.

This was tested end-to-end!

I hope I helped!

[harsmarvania57]

Hi,

"Run a script" alert action is deprecated, you need to move to new framework called "Custom Alert Action". Have a look at document https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ModAlertsIntro and you'll get idea.

[arun_kant_sharm]

I am using below search string:

source=*license_usage.log type="RolloverSummary" earliest=@d | stats sum(b) AS used max(stacksz) AS quota by _time | eval usedGB=round(used/1024/1024/1024,3) | eval quotaGB=round(quota/1024/1024/1024,3) | eval percentage=round(usedGB / quotaGB, 3)*100 | table _time usedGB, quotaGB, percentage, used, quota | where percentage > 80

What is the right way to trigger script with a alert ?