Getting Data In

Run a Linux shell script with Alert Action in the standard Search app.

konpa01
New Member

I am running version 8.x. I want to add the capability to run a custom Linux bash script as Alert Action with the OOTB search app. I did the following:

1 - create a file called alert_actions.conf in the /opt/splunk/etc/apps/search/default directory and have the following content.
[sendsnmptrap]
is_custom = 1
label = Send SNMP Traps
description = Custom action to send search result as SNMP traps
ttl = 120
disabled = 0

----how can I call the script?

2 - I create the script in as /opt/splunk/etc/apps/search/bin/sendsnmptrap.sh with the very basic command & parameter

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First off, DO NOT edit in etc/apps/search/default, it will get overwritten on update of splunk, instead use local: https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Configurationfiledirectories#About_the_defa...

That being said, you can call scripts using the Run a script alert action: https://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/Runscriptaction or by properly implementing a custom alert using the Modular Alert framework: https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/ModAlertsIntro

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...