Why is my alert action script resulting in "Error while executing script [Error 193] %1 is not a valid Win32 application"?


I have an alert set up in Splunk that is running a script action.

The script is calling a Windows .bat file, but no matter how simple I make the script, it throws this error in splunkd.log

Error while executing script [Error 193] %1 is not a valid Win32 application

This script was working a couple months ago. Since then, we have upgraded to 6.4.2. I am not sure if that is the cause, but it is the most significant thing to occur in that time. This is in our test environment, the scripts are still working in our prod environment which has not been upgraded.

Has anyone experienced this error before, did they find a workaround/fix?


Splunk Employee
Splunk Employee


I'm experiencing a similar behavior with splunk reload deploy-server in a command shell
6.4.3 + Windows 2012 R2
I've found a workaround by doing splunk login before running the command

no idea if the workaround could work in your case

0 Karma


This is a script you are running ad-hoc or as part of an alert? The script we are having the issue with is being run as a script action.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...