topic Re: Add-On Builder Alert Action Alert Description in Splunk Dev

Add-On Builder Alert Action Alert Description

addOnGuy — Mon, 22 Jan 2024 21:17:52 GMT

I've been searching for awhile, but I haven't been able to find how to access an alert's description from within my add-on's alert action Python code. I'm using helper.get_events() to get the alert's triggered events and helper.settings to get the title of the alert. Both are from https://docs.splunk.com/Documentation/AddonBuilder/4.1.4/UserGuide/PythonHelperFunctions. That documentation page doesn't seem to list any way to pull an alert's description though. Does anyone know where it's stored/how to access it?

Re: Add-On Builder Alert Action Alert Description

VatsalJagani — Fri, 26 Jan 2024 12:56:08 GMT

@addOnGuy - I don't think there is any direct way to get the alert description. So you would need to make API REST call to saved/searches endpoint to find all the details about the alert.

https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D

https://<host>:<mPort>/services/saved/searches/{name}

As you mentioned you got the alert name already, replace it here and you will get the other details including the description.

I hope this helps!!!