topic Re: Send table format query result from splunk to slack in Other Usage

How to send table format query result from Splunk to Slack?

skumarr — Mon, 01 May 2023 11:17:58 GMT

I have a requirement where i want send the above query result from splunk to slack as an FYI alert. But somehow i am not able to achieve it and i am unable find the right documents to processed. I did try to print using $result.req$ $result.method$ and $result.percentile99$ but i get to see the slack message for just 1st row.
But i would need the complete query to be shown in slack message. How do i achieve this ?

@ITWhisperer or anyone please help me out here

Re: Send table format query result from splunk to slack

PickleRick — Sun, 30 Apr 2023 08:22:07 GMT

I don't know this particular add-on so I'm only speculating here but it is possible that the action allows only sending a single row from the results. In that case you'd have to either modify the script to include more rows (which might be tricky and will give you additional maintenance burden in the future) or you can rework your search to return values in a single row (possibly using multivalued fields)

Re: Send table format query result from splunk to slack

skumarr — Sun, 30 Apr 2023 09:10:01 GMT

Can you help me with some examples @PickleRick on how to return list of rows into 1 single row and get that displayed in slack

Re: Send table format query result from splunk to slack

PickleRick — Sun, 30 Apr 2023 18:49:30 GMT

It really depends on what you want to achieve but the easiest thing for starters would be to do

| stats values(*) as *

Re: Send table format query result from splunk to slack

burwell — Sun, 30 Apr 2023 21:02:37 GMT

Yes so you can only refer to field names but not get multiple values of a field so you need to use stats or eval to create the fields you want

So like @PickleRick suggests

stats values(*) AS *

And then use the actual fieldname in the body of the Slack alert eg $yourfield$

Here are more ideas https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-custom-alert-message-with-variables/m-p/438380#M174048