Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF



Use the sendalert command to invoke a custom alert action. The command gathers the configuration for the alert action from alert_actions.conf, the saved search and custom parameters passed using the command arguments and performs token replacement. Then, the command determines the alert action script and arguments to run, creates the alert action payload and executes the script, handing over the payload via STDIN to the script process.

When running the custom script, the sendalert command honors the maxtime setting from alert_actions.conf and terminates the process if it runs longer than the configured threshold (by default this is set to 5 minutes).

See "Advanced options for working with custom alert actions" in the Developing Views and Apps for Splunk Web manual.


sendalert <alert_action_name> [results_link=<url>] [results_path=<path>] [param.<name>=<"value">...]

Required arguments

Syntax: <alert_action_name>
Description: The name of the alert action configured in the alert_actions.conf file

Optional arguments

Syntax: results_link=<url>
Description: Set the URL link to the search results.
Syntax: results_path=<path>
Description: Set the location to the file containing the search results.
Syntax: param.<name>=<"value">
Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message.


Example 1: Invoke an alert action without any arguments. The alert action script handles checking whether there are necessary parameters that are missing and report the error appropriately.

... | sendalert myaction

Example 2: Trigger the hipchat custom alert action and pass in room and message as custom parameters.

... | sendalert hipchat param.room="SecOps" param.message="There is a security problem!"

Example 3: Trigger the servicenow alert option.

... | sendalert servicenow param.severity="3" param.assigned_to="DevOps" param.short_description="Splunk Alert: this is a potential security issue"

About searches in the CLI

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters