I recently spent quite some time testing the Run a script alert action in Splunk Enterprise on Windows and wanted to share the result, since there seems to be some confusion around how it works. Details on my Environment: Splunk Enterprise 10.4.1 Build: 5a009d941268 Windows Python 3.13 The alert was a scheduled alert with the Run a script action, where the configuration only requires the script filename. The important discovery was that Splunk does not need to pass the actual search results as command-line parameters. When Splunk executes the script, it provides the documented SPLUNK_ARG_* environment variables. In particular: SPLUNK_ARG_0 → script name SPLUNK_ARG_1 → number of results SPLUNK_ARG_2 → search terms SPLUNK_ARG_3 → query SPLUNK_ARG_4 → saved search name SPLUNK_ARG_5 → trigger reason SPLUNK_ARG_6 → saved search URL SPLUNK_ARG_7 → deprecated/empty SPLUNK_ARG_8 → path to the search results file The key was SPLUNK_ARG_8. It points to a file similar to: C:\Program Files\Splunk\var\run\splunk\dispatch\...\results.csv.gz   The file is gzip-compressed CSV. A BAT wrapper can pass that path to Python, and Python can then decompress and parse the results. Just to inform you that after many attempts, I  finally successfully tested the complete chain: Scheduled Alert ↓ Run a Script ↓ BAT ↓ SPLUNK_ARG_8 ↓ results.csv.gz ↓ Python ↓ CSV parsing ↓ Actual alert results   So, yes — the Run a Script alert action works on Windows with Splunk Enterprise 10.4.1, and it is possible to reliably consume the actual search results from the script. One important caveat: Splunk 10.4.1 displays a warning that Run a script is deprecated and recommends using a custom alert action for new implementations, however “Run a Script” Alert Action Actually Work on Windows fine. This was tested end-to-end! I hope I helped! ... View more

Hallo dear! Did you find any solution to your problem here finally? 😥 I have the same exact problem... ... View more

I face the SAME exactly problem. Any solution? ... View more

I don;t know how you can disable thism however if you want to use it, this procedure worked for me for using the CA certificate: You check the check box “use Custom CA Certificate” and Grab the CyberVision’s Certificate Text via PowerShell, by opening your Administrator PowerShell window, and copy and paste this exact command block and press Enter:  $webRequest = [System.Net.WebRequest]::Create("https://<your cybervision's url>") try { $webRequest.GetResponse() } catch {} $cert = $webRequest.ServicePoint.Certificate [System.Convert]::ToBase64String($cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert), [System.Base64FormattingOptions]::InsertLineBreaks) Then certificate will be spit out. ATTENTION  You need afterwards to include the above generated certificate from the powershell into this below form , and add it in the text box of the spulnk’s configuration window like this:   -----BEGIN CERTIFICATE----- PASTE_YOUR_POWERSHELL_TEXT_CERTIFICATE HERE -----END CERTIFICATE-----     ... View more

The following procedure worked for me fine. I created a mini guide: 1. Setting Up Google SMTP in Splunk To successfully send emails from Splunk via Gmail, you must use an App Password rather than your regular account password. Generate App Password: Go to your Google Account settings, enable 2-Step Verification, and generate a 16-character App Password. Configure Splunk Email Settings: Navigate to Settings > System settings > Email alert settings. Mail host: smtp.gmail.com:465. Email security: SSL. Username: Your full Gmail address. Password: Paste the 16-character (without spaces) App Password here. Click Save. 2. How to Trigger/Test the Alert You can verify your configuration by running a manual test command in the search bar. This confirms your SMTP settings are correct without needing to wait for a real event. Run Test Command: Use the following command in the Splunk Search bar: index=_internal | head 1 | sendemail to="[email protected]" subject="Test Alert" message="Splunk SMTP is working" sendresults=true format=table sendcsv=false. Expected Outcome: If the configuration is correct, you will receive a test email, and the search will display "The search completed successfully". 3. Setting Up an Automated Alert Once testing is successful, configure an automated trigger for new events: Create Alert: Perform a search for your specific event (e.g., index="your_index"). Save as Alert: Click Save As > Alert. Schedule: Set the Alert type to Scheduled. Frequency: To check every minute, select Run on Cron Schedule and enter */1 * * * *. Time Range: Set the time range to "Last 1 minute" to ensure the alert only triggers for new events within that specific window. Trigger Condition: Set Number of results to is greater than 0. Add Action: Select Add Actions > Send email and enter the recipient address. Important Note: These steps apply to the Enterprise/Trial version. Please be aware that the Free version of Splunk has limitations that prevent these email alert actions from working. ... View more