I noticed script alert action is officially deprecated. No easy way to setup a script triggered by log keyword?

[NakatsuKinichi]

The run a script alert action is officially deprecated. Create a custom alert action to package a custom script instead. Learn more
https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

[manjunathmeti]

Hi @NakatsuKinichi,

Check my answer here to create a custom alert action with a script: https://answers.splunk.com/answers/810829/problem-with-scripted-alert.html#answer-810832

Once you create custom alert action configure alert with custom action, select Trigger condition as custom and set condition something like:

| where log_keyword <>= "match_value_ or_count"

OR

| where some conditional logic on log_keyword field values.

For more simplicity you can add conditional logic on log_keyword field values in the alert query itself and set Trigger condition to trigger when number of results is greater than 0.