All Apps and Add-ons

ScriptRunner - "Couldn't start child process" error when trying to execute a custom alert action script?

TimEek
Path Finder

As the title suggests, Im getting the following error when trying to execute a custom alert action script.

The script is quite simple. Its a shell script that basically looks like this:

#!/bin/bash
if [[ "$1" == "--execute" ]]; then
https_proxy=proxyname:port curl --header "content-type: text/soap+xml; charset=UTF-8" --data @alertBody.xml https://url/api
fi

If I execute this through the command line using: sh alert.sh --execute, it works perfectly. But I get the above error instead. It references the script in the following way:

ERROR ScriptRunner - Couldn't start child process. script="/opt/splunk/etc/apps/alert_app/bin/alert.sh --execute"

I am not trying to give arguments to the script. It's a simple script that posts to an API with predetermined text that's always the same in the xml body. My alert actions looks as follows:

[alert]
is_custom=1
label=alertTest
icon_path=logevent.png
disabled=0

Adding some fields didn't help, but maybe someone can help me find which ones are mandatory? I copied the png from another alerting app and placed it in the same folder.

 

Labels (2)
Tags (1)
0 Karma
1 Solution

TimEek
Path Finder

In case anyone finds this in the future.. Problems are usually easier to solve than you think. I discovered that the permissions for my linux systems were out of wack, so chmod 700 on the script was enough to get me through this step. Good luck to anyone else!

View solution in original post

_smp_
Builder

I was getting this error from a scripted input after upgrading from 8.2.10 to 9.0.6, and resolved it by removing python.version = python2 from the restmap.conf file that someone had manually added.

Tags (1)
0 Karma

TimEek
Path Finder

In case anyone finds this in the future.. Problems are usually easier to solve than you think. I discovered that the permissions for my linux systems were out of wack, so chmod 700 on the script was enough to get me through this step. Good luck to anyone else!

alexis
Explorer

good job. thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...