Why is my alert action script resulting in "Error while executing script [Error 193] %1 is not a valid Win32 application"?

[farside41]

I have an alert set up in Splunk that is running a script action.

The script is calling a Windows .bat file, but no matter how simple I make the script, it throws this error in splunkd.log

Error while executing script [Error 193] %1 is not a valid Win32 application

This script was working a couple months ago. Since then, we have upgraded to 6.4.2. I am not sure if that is the cause, but it is the most significant thing to occur in that time. This is in our test environment, the scripts are still working in our prod environment which has not been upgraded.

Has anyone experienced this error before, did they find a workaround/fix?

Thanks.

[maraman_splunk]

Hi,

I'm experiencing a similar behavior with splunk reload deploy-server in a command shell
6.4.3 + Windows 2012 R2
I've found a workaround by doing splunk login before running the command

no idea if the workaround could work in your case

[farside41]

This is a script you are running ad-hoc or as part of an alert? The script we are having the issue with is being run as a script action.