https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-a-configuration-stanza-in-webhook-URL-e-g/m-p/258899#M49701 <P>It appears that it is <STRONG>not</STRONG> possible,<BR /> But there are alternatives.</P> <P>It would involve creating a <STRONG>custom alert action</STRONG>, which is actually a one-alert-app. <BR /> Once installed correctly, it shows in the list of actions in 'add actions', have a user interface, and more.<BR /> Using it, one can have the user explicitly state the required input for the action to complete successfully.</P> <P>Its all here <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro">http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro</A><BR /> However, I could not follow the explanation until I read it from the perspective of it being a separate add-on.</P> <P>I also tried to run a python script instead of a webhook. This option is smooth, but the script has to work out the required data by parsing the attached results, which can be quite challenging; with the webhook, the "fielded" result is attached in JSON</P> Sun, 21 Feb 2016 12:04:26 GMT ramabu 2016-02-21T12:04:26Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-a-configuration-stanza-in-webhook-URL-e-g/m-p/258898#M49700 <P>I am sure this is not an existing syntax <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> and yet - is it possible to encode such URL-s? </P> <P>======================</P> <H1>Feb 10th:</H1> <P>So I will sort of repeat the question:</P> <P>If I POST to e.g. <A href="https://10.41.1.136/splunk/alerts?disposition=3&amp;auth=MyApp%20206eb5cb3c-5c70-4cb7-8844-5a0407a43ca7">https://10.41.1.136/splunk/alerts?disposition=3&amp;auth=MyApp%20206eb5cb3c-5c70-4cb7-8844-5a0407a43ca7</A>, then everything works fine.</P> <P>But '10.41.1.136' and '206eb5cb3c-5c70-4cb7-8844-5a0407a43ca7' actually configurable for the app. Is it possible to save the search in a "formal" format, and have actual values replace the formal ones upon alert being triggered?<BR /> I did see how to reference a result field, but it's is not useful in this case.</P> <P>Thanks<BR /> rama</P> Sun, 31 Jan 2016 07:08:16 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-a-configuration-stanza-in-webhook-URL-e-g/m-p/258898#M49700 ramabu 2016-01-31T07:08:16Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-a-configuration-stanza-in-webhook-URL-e-g/m-p/258899#M49701 <P>It appears that it is <STRONG>not</STRONG> possible,<BR /> But there are alternatives.</P> <P>It would involve creating a <STRONG>custom alert action</STRONG>, which is actually a one-alert-app. <BR /> Once installed correctly, it shows in the list of actions in 'add actions', have a user interface, and more.<BR /> Using it, one can have the user explicitly state the required input for the action to complete successfully.</P> <P>Its all here <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro">http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro</A><BR /> However, I could not follow the explanation until I read it from the perspective of it being a separate add-on.</P> <P>I also tried to run a python script instead of a webhook. This option is smooth, but the script has to work out the required data by parsing the attached results, which can be quite challenging; with the webhook, the "fielded" result is attached in JSON</P> Sun, 21 Feb 2016 12:04:26 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-a-configuration-stanza-in-webhook-URL-e-g/m-p/258899#M49701 ramabu 2016-02-21T12:04:26Z