I understand that Splunk 6.4.1 passes several alert-defined values to a script when an alert action is triggered (http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Configuringscriptedalerts). However, I want to be able to pass in some user-defined parameters as well, in order to distribute the alerts effectively. Normally, I would imagine you could just pass in the arguments where you call upon the script in the alert configuration ("$SPLUNK_HOME/bin/scripts/alert.sh arg1 arg2 arg3"). but I doubt that would work because it looks like the positional arguments are already filled by the alert-defined values.
Is there a way to pass in user-defined values? I tried looking throughout the forums but I'm not getting a concrete answer. I'm leaning toward "No", but wanted to confirm.
If by user-defined
you mean inside the search results
, then yes, you can do it like this: