Getting Data In

Problem with scripted alert

tinpelayee
Engager

Hello plp,

I am making an alert, that export a csv , the problem here is when this .csv is exported, only have rw permissions and i want to have rw-r. I make a script that convert this file with the permissions i want, but is dont working. I have read all the doc of configurating scripted alerts, but i cant resolve this problem.

Can anyone helpme?

0 Karma
1 Solution

manjunathmeti
Champion

Scripted alert action is officially deprecated. Use custom alert action. Check this page to convert scripted action to custom alert action.

https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

Simple steps to create an app for custom alert action:

Step 1: Create new app script_custom_alert_action and create app.conf and alert_actions.conf like below. Copy configuration files to script_custom_alert_action/default.

app.conf

 [ui]
 is_visible = 0
 label = Scripted Custom Alert Action

 [launcher]
 description = Scripted Custom Alert Action

 [install]
 state = enabled
 is_configured = 1 

alert_actions.conf

 [scriptcustomalert]
 is_custom = 1
 label = Scripted Custom Alert Action

Step 2: Rename your script. Script name must be same as stanza name in alert_actions.conf. Example scriptcustomalert.py or scriptcustomalert.sh. Put it in script_custom_alert_action/bin.

Step 3: Create default.meta and copy it in script_custom_alert_action/metadata. This enables all users to configure custom alert action for their alerts in any app.

[]
access = read : [ * ], write : [ admin ]
export = system

Step 4: Deploy app and restart splunk. New action "Scripted Custom Alert Action" will appear in alert action list on UI in alert configurations and you can select it and verify.

View solution in original post

tinpelayee
Engager

thanks , i have read this a lot of times, but i cant resolve the problem.

can you help me with this configuration?

0 Karma

manjunathmeti
Champion

Scripted alert action is officially deprecated. Use custom alert action. Check this page to convert scripted action to custom alert action.

https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/CustomAlertConvertScripted

Simple steps to create an app for custom alert action:

Step 1: Create new app script_custom_alert_action and create app.conf and alert_actions.conf like below. Copy configuration files to script_custom_alert_action/default.

app.conf

 [ui]
 is_visible = 0
 label = Scripted Custom Alert Action

 [launcher]
 description = Scripted Custom Alert Action

 [install]
 state = enabled
 is_configured = 1 

alert_actions.conf

 [scriptcustomalert]
 is_custom = 1
 label = Scripted Custom Alert Action

Step 2: Rename your script. Script name must be same as stanza name in alert_actions.conf. Example scriptcustomalert.py or scriptcustomalert.sh. Put it in script_custom_alert_action/bin.

Step 3: Create default.meta and copy it in script_custom_alert_action/metadata. This enables all users to configure custom alert action for their alerts in any app.

[]
access = read : [ * ], write : [ admin ]
export = system

Step 4: Deploy app and restart splunk. New action "Scripted Custom Alert Action" will appear in alert action list on UI in alert configurations and you can select it and verify.

tinpelayee
Engager

i can created but my script doesnt change the permissions of the csv 😞

0 Karma

manjunathmeti
Champion

I tested with below python script and it's working. Check with this script.

scriptcustomalert.py

Search query I used:

index=_internal earliest=-5m | stats count by sourcetype | outputcsv test.csv
0 Karma

tinpelayee
Engager

Thanks Bro, it works!!!!

0 Karma

tinpelayee
Engager

thanks , i have read this a lot of times, but i cant resolve the problem.

can you help me with this configuration?

0 Karma

manjunathmeti
Champion

Updated my answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...