It is documented in the following page here: http://docs.splunk.com/Documentation/Splunk/6.6.3/AdvancedDev/CustomAlertConvertScripted "For custom alert actions, use configuration file parameters to access and pass values to the configuration payload that the alert action receives." Meaning you can't use SPLUNK_ARG_X arguments, these need to be called upon from a configuration file. ... View more