Getting Data In

I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?

NakatsuKinichi
Engager

The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead. Learn more
https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @NakatsuKinichi,

Check my answer here to create a custom alert action with a script: https://answers.splunk.com/answers/810829/problem-with-scripted-alert.html#answer-810832

Once you create custom alert action configure alert with custom action, select Trigger condition as custom and set condition something like:

| where log_keyword <>= "match_value_ or_count"

OR

| where some conditional logic on log_keyword field values.

For more simplicity you can add conditional logic on log_keyword field values in the alert query itself and set Trigger condition to trigger when number of results is greater than 0.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...