https://community.splunk.com/t5/Splunk-On-Call/How-to-get-custom-alert-fields-or-just-alert-raw-on-custom/m-p/638272#M92 <P>hi, we have a bunch of fields that show up in the Splunk Oncall/VictorOps UI. under either "Alert Details &gt; Alert Data &gt; Alert Fields" or "Annotations" (screenshot below) that i'm hoping to insert into the payload body of a&nbsp;<A href="https://help.victorops.com/knowledge-base/custom-outbound-webhooks/#suggested-variables" target="_self">custom outbound webhook</A>&nbsp; of "Any-Incident" event type.</P><P data-unlink="true">When using the VictorOps API i only see the custom fields present under the "raw" field of the <A href="https://portal.victorops.com/public/api-docs.html#!/Alerts/get_api_public_v1_alerts_uuid" target="_self">GET Alert response</A>.</P><P data-unlink="true">I see in the <A href="https://help.victorops.com/knowledge-base/incident-fields-glossary/" target="_self">Incident Fields</A> support page some mention of custom_fields, which makes me think perhaps we could add those to payload with something like ${{ALERT.custom_fields}}, or ${{ALERT.raw}}, but at least when i tried those nothing was populated on the webhook payload for it</P><P data-unlink="true">Since i havent been able to find documentation on how to add these custom fields, annotations, or raw alert payload to the webhook payload body and they dont appear within the suggested variables, does someone know how we would add those to the webhook body or if thats possible?&nbsp; Or do i need to pull them from the Alert.raw field myself and if so how would i get that raw field on the webhook payload?</P><P data-unlink="true">&nbsp;</P><P data-unlink="true">Thanks!</P><P>"<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-04-02 at 3.30.52 PM.png" style="width: 474px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24668i93DF643A9C259C6E/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2023-04-02 at 3.30.52 PM.png" alt="Screenshot 2023-04-02 at 3.30.52 PM.png" /></span></P> Tue, 04 Apr 2023 17:40:03 GMT whyNot 2023-04-04T17:40:03Z https://community.splunk.com/t5/Splunk-On-Call/How-to-get-custom-alert-fields-or-just-alert-raw-on-custom/m-p/638272#M92 <P>hi, we have a bunch of fields that show up in the Splunk Oncall/VictorOps UI. under either "Alert Details &gt; Alert Data &gt; Alert Fields" or "Annotations" (screenshot below) that i'm hoping to insert into the payload body of a&nbsp;<A href="https://help.victorops.com/knowledge-base/custom-outbound-webhooks/#suggested-variables" target="_self">custom outbound webhook</A>&nbsp; of "Any-Incident" event type.</P><P data-unlink="true">When using the VictorOps API i only see the custom fields present under the "raw" field of the <A href="https://portal.victorops.com/public/api-docs.html#!/Alerts/get_api_public_v1_alerts_uuid" target="_self">GET Alert response</A>.</P><P data-unlink="true">I see in the <A href="https://help.victorops.com/knowledge-base/incident-fields-glossary/" target="_self">Incident Fields</A> support page some mention of custom_fields, which makes me think perhaps we could add those to payload with something like ${{ALERT.custom_fields}}, or ${{ALERT.raw}}, but at least when i tried those nothing was populated on the webhook payload for it</P><P data-unlink="true">Since i havent been able to find documentation on how to add these custom fields, annotations, or raw alert payload to the webhook payload body and they dont appear within the suggested variables, does someone know how we would add those to the webhook body or if thats possible?&nbsp; Or do i need to pull them from the Alert.raw field myself and if so how would i get that raw field on the webhook payload?</P><P data-unlink="true">&nbsp;</P><P data-unlink="true">Thanks!</P><P>"<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-04-02 at 3.30.52 PM.png" style="width: 474px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24668i93DF643A9C259C6E/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2023-04-02 at 3.30.52 PM.png" alt="Screenshot 2023-04-02 at 3.30.52 PM.png" /></span></P> Tue, 04 Apr 2023 17:40:03 GMT https://community.splunk.com/t5/Splunk-On-Call/How-to-get-custom-alert-fields-or-just-alert-raw-on-custom/m-p/638272#M92 whyNot 2023-04-04T17:40:03Z