Is There an Easy Guide to Create a Custom Alert Action to Run a Batch File or PowerShell Script

[Salvador_Dalí]

I don't understand why the legacy 'run a script' alert action has been deprecated.  The official guidelines to create a 'Custom Alert Action' are to complicated to follow.

I attempted to find a guide from Google, but there are too many conflicting methods, and I consistently failed to implement them.

I just want a simple and straightforward guide to create a 'Custom Alert Action'  that runs a batch file (script.bat) or a PowerShell script file (script.ps1) when the alert is triggered. 

Or just create a 'custom alert action' that exactly do the same thing as the deprecated 'run a script' alert action. (Just type the batch file name and that's it)

Environment: Splunk Enterprise 9.1 (Windows)

[livehybrid]

Hi @Salvador_Dalí 

To create a simple custom alert action that runs a batch file (script.bat) or PowerShell script (script.ps1) on Windows in Splunk Enterprise 9.x, you'll need to build a basic Splunk app with a custom modular alert. This replaces the deprecated "run a script" action. 

1. Create a new app directory on your Splunk server, navigate to $SPLUNK_HOME/etc/apps/ and create a new folder, e.g., myorg_custom_action.

2. Create default/alert_actions.conf with:

   [my_script_action]
   is_custom = 1
   label = Run My Script
   description = Runs a batch or PowerShell script
   payload_format = json

3. Create default/app.conf with basic app metadata:

   [ui]
   is_visible = 0  
   # Hide from app list because this isnt a UI based app...
   
   #... etc.

4. Create bin/my_script_action.py (the Python script that executes your batch/PS script). Use this template to get you started:

   python
        import sys
        import json
        import subprocess
   
        # Read payload from stdin
        payload = json.loads(sys.stdin.read())
   
        # Define your script path (absolute path on the Splunk server)
        script_path = "C:\\path\\to\\your\\script.bat"  # Or .ps1 for PowerShell
   
        # Run the script (use powershell.exe for .ps1)
        if script_path.endswith('.ps1'):
            subprocess.call(['powershell.exe', '-File', script_path])
        else:
            subprocess.call([script_path])
   
        sys.exit(0)

5. If you want to pass alert data to the script, modify the Python to write payload to a file or pass as args, then adjust your batch/PS script accordingly.

6. Restart Splunk ($SPLUNK_HOME/bin/splunk restart). The action "Run My Script" will appear in alert configuration under "Add Actions".

7. Test: Create a test alert, add your custom action, and trigger it to verify the script runs.

This is a minimal setup, I would recommend extending it for error handling or parameters as required.

Custom alert actions are modular apps that allow flexible scripting. The Python handler example reads the alert payload and executes your external script using subprocess. This works on Windows but ensure the Splunk service account has permissions to run the scripts.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Salvador_Dalí]

It didn't work.  The alert is triggered but the batch still didn't run. 

[PrewinThomas]

@Salvador_Dalí 

The run a script alert action is officially deprecated. 
You can better try with a custom alert action app.

Create custom alert action app with bin, default, and metadata folders
Eg:
$SPLUNK_HOME/etc/apps/custom_alert_action/bin/
Put your script.bat inside the bin/ folder

Inside default/, create alert_actions.conf

[run_script]
is_custom = 1
label = Run Script
description = Executes a script
script = script.bat

Also in default/, create app.conf

[install]
state = enabled

[ui]
is_visible = true

Restart Splunk
After restarting, your alert action “Run Script” will show up in the alert UI

#https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/configure-alert-a...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[Salvador_Dalí]

Didn't work. The alert is triggered but the batch didn't run.