Custom alert action component reference

Review required and optional custom alert action components and app directory structure.

App directory structure

Here is the directory layout of an app that includes a custom alert action.

 
[app_name]
    appserver
        static
            [app_icon].png
            [alternative_icon].png

    bin
        [custom_alert_action_script]

    default
        alert_actions.conf
        app.conf
        restmap.conf
        setup.xml
        data
            ui
                alerts
                    [custom_alert_action].html

    metadata
        default.meta

    README
        alert_actions.conf.spec
        savedsearches.conf.spec

App components

This app directory has the following components.

Component	File	Description	Required?
Logic	[custom_alert_action_script]	Alert action script or executable file	Yes
User interface	[custom_alert_action].html	HTML file defining the user interface for alert configuration	Yes
Alert action configuration	alert_actions.conf	Registers the custom alert action	Yes
Spec files	alert_actions.conf.spec	Declares alert action parameters	Optional
	savedsearches.conf.spec	Declares alert action parameters configured in the local savedsearches.conf file for the Splunk platform instance.	Optional
App configuration	app.conf	Defines app package and UI information	Yes
Icons	[app_icon].png	One or more icon image file(s)	Optional
Setup	setup.xml	Defines a UI for populating global settings at setup time	Optional
Validation	restmap.conf	Defines validation for parameters declared in savedsearches.conf	Optional
Access control metadata	default.meta	Defines alert action permission and scope	Optional

Confidential information storage

Additionally, you can opt to use the password storage endpoint to store confidential information in an encrypted format. See Confidential information storage.