Restarting splunk is not required. It is enough to refresh the config. To reload your endpoints type the following into your browser: http://<yoursplunkserver>:8000/en-US/debug/refresh Ref: https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Configurationfilechangesthatrequirerestart#When_to_restart_splunkd ... View more

The logs are ingested and can be seen via SPL: index=_internal sourcetype=splunkd component=sendmodalert action="{action}" See http://docs.splunk.com/Documentation/Splunk/6.4.2/AdvancedDev/ModAlertsLog#Access_alert_action_script_logs ... View more

Why didn't you link to the "newer and better answer" so others can benefit as well? ... View more