Error message: Script execution failed for external search command 'runshellscript'.

Applicability

Splunk Enterprise Splunk Cloud

Description

This feature shows in release documentation as deprecated, but this document calls it internal/unsupported/experimental. Splunk will support this feature until/unless it is removed (removal would be documented in release notes). The functionality to use scripted trigger actions is still in place as of Splunk 10.0. Splunk suggests instead using custom alert actions from an app context.

Syntax has changed for this command, using this feature may encounter error messages like these in splunkd.log if their syntax has not yet been updated:

12-15-2022 16:12:58.871 -0600 ERROR script [1349494 SchedulerThread] - SearchMessage orig_component=script sid=AlertActionsRequredFields_1671142378.1829 message_key=EXTERN:RUNSHELLSCRIPT_INVALID_SID__%s message=Invalid search ID ''.
12-15-2022 16:12:58.871 -0600 ERROR script [1349494 SchedulerThread] - Script execution failed for external search command 'runshellscript'.
12-15-2022 16:12:58.871 -0600 WARN SearchScheduler [1349494 SchedulerThread] - addRequiredFields: SearchProcessorException is ignored, sid=AlertActionsRequredFields_1671142378.1829, error=Error in 'script': Script execution failed for external search command 'runshellscript'

 

Investigation

This is a benign message -- the 'runshellscript' actually does complete. The message only occurs on HFs (and indexers).

This message is safe if no other alert actions are attached to that search. The required fields logic is in place for all alert actions, but is not used in the scripted alert action, so the logic is not needed. However, a performance impact could occur if other alert actions are attached to the search.

Syntax has changed for this alert. These messages can be eliminated by updating script syntax.

Resolution

Options (choose one):

1. Ignore message as benign.
2. Eliminate message per documentation by updating existing script syntax from: 

   runshellscript <script-filename> <result-count> <search-terms> <search-string> <savedsearch-name> <description> <results-url> <deprecated-arg> <results_file>

   to 

   runshellscript <script-filename> <result-count> <search-terms> <search-string> <savedsearch-name> <description> <results-url> <deprecated-arg> <search ID> <path to results_file (deprecated-arg)>

3. Eliminate message by setting precalculate_required_fields_for_alerts = 0 in /local/savedsearches.conf file -- add to the stanza for the saved search associated with the affected 'run a script' trigger action.
4. Convert existing scripted trigger actions into "custom alert actions" from the context of a custom app, as "custom alert actions" is the recommended method for capturing scripted data, and "scripted trigger actions" functionality may eventually be removed from Splunk:
   • Create custom alert action

Related Links

• https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Runshellscript
• https://docs.splunk.com/Documentation/Splunk/Latest/AdvancedDev/CustomAlertConvertScripted
• https://docs.splunk.com/Documentation/Splunk/Latest/AdvancedDev/CustomAlertConvertScripted#Accessing_script_argument_values_in_a_custom_alert_action

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release