Building for the Splunk Platform

What could be the reason custom app alert is not working?

Path Finder

I have created a custom app and I get this error in Splunk 


 Error in 'sendalert' command: Alert action script for action "list_ip" not found.



I am using list_ip in both alert_actions.conf and commands.conf. The Python file is in /bin. What could be the reason for this error?


Here are the file contents




filename =
command.arg.1 = $results.file$





label = List IP
description = This action will send IP addresses to a custom webhook
icon_path = icon.png
is_custom = 1
payload_format = json


#!/usr/bin/env python3

import csv
import json
import requests
import sys

def send_webhook(ip_list):
    url = ""
    headers = {
        "Content-Type": "application/json; charset=utf-8"
    data = {
        "ips": ip_list
    response =, data=json.dumps(data), headers=headers)

def main():
    if len(sys.argv) > 1:
        results_file = sys.argv[1]  # retrieve the results file passed as argument
        ip_list = []

        with open(results_file, 'r') as file:
            reader = csv.DictReader(file)
            for row in reader:

        print("No arguments provided.")

if __name__ == "__main__":



0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...