Hi, I have not been working with Splunk for long but I have come across a lot of issues trying to get it to trigger a custom script. I then noted that the 'feature' had been deprecated and in the resulting searching came across people talking about creating custom alert actions. In my head this seems to suggest that the original way is left in for legacy so defining a new one is your best bet. Am I right here? I had a quick look in the alert_actions.conf and found the stanza for the original function. If you were to try and create your own how would it be any different? When I say different I mean in order to get it to work. I personally think I have made assumptions that are incorrect around why you would want to create a customer alert action in the first place. Looking at it at all is driven purely through frustration in not being able to run my shell script. ... View more