What capability is required to be able to execute a shell script when an alert is fired?

[robertlight]

I cannot run a shell script as part of my alert. It is clear that I need my user to have a particular splunk capability - when I add the "admin" role, I am able to run my shell script, without "admin" role, I get an error saying it can't find search "runshellscript"

What splunk "capability" is required to run a shell script??

[robertlight · Accepted solution]

The capability "edit_scripted" is required to use the "runshellscript"

I don't see where splunk documenation states this but via trial and error (in v6.2.2) it is indeed the case.

[Yasaswy]

Hi.. I don't think there is a specific capability requirement to allow scripts within alerts. As along as "schedule_search" capability is allowed for the role. The users within that role should be able to setup script for alert actions.
There is very good documentation for setting up alerts here
Some info on troubleshooting here

Hope the info resolves your current issue.

[robertlight]

I'm able to schedule the alert, but when the alert is fired, the 'runshellscript' search term can't be fired. But when I add role 'admin' to my user, I don't get the error and 'runshellscript' is runnable.

Hence my suspicion that my user is lacking a 'capability'.

[Yasaswy]

Ah.. reasonable suspicion. The list of offered capabilities is not that long .. and nothing seems to jump out pointing to this specific retirement (for me). So if you set any other kind of alert (email for eg).. does it work (without needing admin role)? What are the permissions on the script?