sendalert command to invoke a custom alert action. The command gathers the configuration for the alert action from the
alert_actions.conf file and the saved search and custom parameters passed using the command arguments. Then the command performs token replacement. The command determines the alert action script and arguments to run, creates the alert action payload and executes the script, handing over the payload by using STDIN to the script process.
When running the custom script, the
sendalert command honors the
maxtime setting from the
alert_actions.conf file and terminates the process if the process runs longer than the configured threshold. By default the threshold is set to 5 minutes.
See "Advanced options for working with custom alert actions" in the Developing Views and Apps for Splunk Web manual.
sendalert <alert_action_name> [results_link=<url>] [results_path=<path>] [param.<name>=<"value">...]
- Syntax: <alert_action_name>
- Description: The name of the alert action configured in the
- Syntax: results_link=<url>
- Description: Set the URL link to the search results.
- Syntax: results_path=<path>
- Description: Set the location to the file containing the search results.
- Syntax: param.<name>=<"value">
- Description: The parameter name and value. You can use this name and value pair to specify a variety of things, such as a threshold value, a team name, or the text of a message.
When you use the
sendalert command in an ad hoc search, the command might be called multiple times if there are a large number of search results. This occurs because preview is enabled, which is the default setting. Turn off preview to avoid the command being called multiple times.
sendalert command is included in a saved search, such as a scheduled report or a scheduled search, the command is called only one time.
Example 1: Invoke an alert action without any arguments. The alert action script handles checking whether there are necessary parameters that are missing and report the error appropriately.
... | sendalert myaction
Example 2: Trigger the hipchat custom alert action and pass in room and message as custom parameters.
... | sendalert hipchat param.room="SecOps" param.message="There is a security problem!"
Example 3: Trigger the servicenow alert option.
... | sendalert servicenow param.severity="3" param.assigned_to="DevOps" param.short_description="Splunk Alert: this is a potential security issue"
About searches in the CLI
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7