Hello,
I'm trying to create to custom alert action from alert manager app to automate emails with invoking action. I add this on alert_action.conf. Its not working as expected. Any suggestions?
[snow_email]
is_custom = 1
label = SNOW action
disabled = 0
command = |sendalert sendemail "to=test@service.now.com" "server=relay.test.com" "from=splunk@test.com" "subject=test22"
I dont think you need the |sendalert
at the start of the command, the sendemail
should be sufficient
I tried, its working with regular alerts, but not from the app actions.