Splunk App for AWS: JSON formatting for AWS SNS alert

sduchene_splunk — Thu, 31 Aug 2017 10:41:14 GMT

I need to pass JSON formatted data to the AWS SNS alert.
What I have is a table. I created an SNS alert (save as alert->choose AWS SNS)
When sent through SNS alert the format is not JSON.
How can I format this table in JSON?

Re: Splunk App for AWS: JSON formatting for AWS SNS alert

sduchene_splunk — Thu, 31 Aug 2017 10:48:08 GMT

idea 1 : use the json tool app https://splunkbase.splunk.com/app/3540/ (note, i haven't tried it, but seems to do the job)
idea 2 : use SPL to create a new field containing the entire line into JSON format, and pass this field to sns alert

this uses foreach command,

index=xx
| eval message="{"
| foreach *
[eval message=if("<>"="message", message, message. " \"". "<>" . "\" : \"".<>."\", ")]
| eval message=rtrim(message, " ,")| eval message=message." }"

--
then finally pass the field message : $result.message$ to sns alert

topic Splunk App for AWS: JSON formatting for AWS SNS alert in All Apps and Add-ons

Splunk App for AWS: JSON formatting for AWS SNS alert

Re: Splunk App for AWS: JSON formatting for AWS SNS alert

this uses foreach command,