Building for the Splunk Platform

Custom Alert Action UI Params not saving

Path Finder


I have created a custom alert action app as specified in the Splunk development documentation. I also created another more basic app to test and am still having the same issue. The issue is that the custom alert action ui params are not saving. If I manually add the action.testalert.param.subject to the entry in savedseraches.conf it will get passed to my script, but when I save the parmas from the UI they do not get back to the config file.



is_custom = 1
label = Test Alert
payload_format = json

# A default param = Bar



The alert action UI


<splunk-control-group label="Subject">
    <splunk-text-input name="action.testalert.param.subject" id="subject">



I have tried including a savedsearches.conf.spec to define the custom param with no effect and have also attempted changing the permissions/exports in default.meta with no success. Any idea what is going on?

Labels (1)
0 Karma



I suppose the subject parameter is defined on alert_actions.conf, right?

Also, I had a similar issue a while ago, and I guess It was solved by adding a alert_actions.conf.spec file containing my parameters and Its data types. 

Something like:

param.my_param = <string>

In my app I have placed this file under README dir.

0 Karma

Path Finder

I created a spec file for alert_actions.conf and this did not change anything unfortunately. 


Same here, have you figured it out, maybe?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...