Splunk Dev

Custom Alert Action UI Params not saving

knutsod
Path Finder

Hello,

I have created a custom alert action app as specified in the Splunk development documentation. I also created another more basic app to test and am still having the same issue. The issue is that the custom alert action ui params are not saving. If I manually add the action.testalert.param.subject to the entry in savedseraches.conf it will get passed to my script, but when I save the parmas from the UI they do not get back to the config file.

alert_actions.conf

 

[testalert]
is_custom = 1
label = Test Alert
payload_format = json

# A default param
param.foo = Bar

 

 

The alert action UI

 

<splunk-control-group label="Subject">
    <splunk-text-input name="action.testalert.param.subject" id="subject">
    </splunk-text-input>
</splunk-control-group>

 

 

I have tried including a savedsearches.conf.spec to define the custom param with no effect and have also attempted changing the permissions/exports in default.meta with no success. Any idea what is going on?

Labels (1)
0 Karma

alonsocaio
Contributor

Hi,

I suppose the subject parameter is defined on alert_actions.conf, right?

Also, I had a similar issue a while ago, and I guess It was solved by adding a alert_actions.conf.spec file containing my parameters and Its data types. 

Something like:

[my_alert_action]
param.my_param = <string>

In my app I have placed this file under README dir.

0 Karma

knutsod
Path Finder

I created a spec file for alert_actions.conf and this did not change anything unfortunately. 

k_ivesic
Explorer

Same here, have you figured it out, maybe?

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...