Building for the Splunk Platform

Custom Alert Action UI Params not saving

Path Finder


I have created a custom alert action app as specified in the Splunk development documentation. I also created another more basic app to test and am still having the same issue. The issue is that the custom alert action ui params are not saving. If I manually add the action.testalert.param.subject to the entry in savedseraches.conf it will get passed to my script, but when I save the parmas from the UI they do not get back to the config file.



is_custom = 1
label = Test Alert
payload_format = json

# A default param = Bar



The alert action UI


<splunk-control-group label="Subject">
    <splunk-text-input name="action.testalert.param.subject" id="subject">



I have tried including a savedsearches.conf.spec to define the custom param with no effect and have also attempted changing the permissions/exports in default.meta with no success. Any idea what is going on?

Labels (1)
0 Karma



I suppose the subject parameter is defined on alert_actions.conf, right?

Also, I had a similar issue a while ago, and I guess It was solved by adding a alert_actions.conf.spec file containing my parameters and Its data types. 

Something like:

param.my_param = <string>

In my app I have placed this file under README dir.

0 Karma

Path Finder

I created a spec file for alert_actions.conf and this did not change anything unfortunately. 


Same here, have you figured it out, maybe?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...