Alerting

What is the difference between a custom alert action and a scripted alert action?

nagarjuna280
Communicator

What is the difference between a custom alert action and a scripted alert action? We use the script in both actions: why do we need to create an app for custom alert actions? Instead, we can just use a script to generate an alert.

Tags (3)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @nagarjuna280,

Scripted Alert has been deprecated and it has been replaced with Custom Alert action so that's why it will be good to migrate from Scripted Alert to Custom Alert actions.

With custom alert actions you can pass different values which are not present in Splunk query output but it is require to run the script this is one of the advantage and custom alert actions runs on different framework compared to scripted alert and due to that you need to create App for custom alert actions, which contains different configuration files, html file and script.

View solution in original post

harsmarvania57
Ultra Champion

Hi @nagarjuna280,

Scripted Alert has been deprecated and it has been replaced with Custom Alert action so that's why it will be good to migrate from Scripted Alert to Custom Alert actions.

With custom alert actions you can pass different values which are not present in Splunk query output but it is require to run the script this is one of the advantage and custom alert actions runs on different framework compared to scripted alert and due to that you need to create App for custom alert actions, which contains different configuration files, html file and script.

tom_frotscher
Builder

Hi,

you can of course just use the scripted alert action. The custom alert action is just more of a "framework concept".
For example, you have better integration in the UI, where you can configure parameters for the script. You can package the script as an app and share it via splunk base or in your environment. Those things just makes it more flexible. If you do not need this flexibility, you might have no need to use a custom alert action.

Greetings

Tom

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...