topic Re: Splunk Add-on - multi select values in an alert action in Splunk Enterprise Security

Splunk Add-on - multi select values in an alert action

shacharh — Sun, 10 Feb 2019 15:59:05 GMT

Hi,

I'm working on an add-on for Splunk. I added an alert action, and I'm adding some fields to it.
How can I add a dynamic multi-select field? The use case - I query Splunk, display the values, and allow the user to select some or all of them. The closest thing I've found is Splunk's splunk-search-dropdown, but it is only for single select.

Thanks,
Shachar

Re: Splunk Add-on - multi select values in an alert action

lakshman239 — Mon, 11 Feb 2019 16:39:32 GMT

would it be of any issue, if you concatenate the multiple values selected by user to something like "value1, value2,value3" and send it your alert actions, where you can act based on value1, 2 3?

Re: Splunk Add-on - multi select values in an alert action

shacharh — Mon, 11 Feb 2019 16:45:08 GMT

@lakshman239 If you mean that the user would be able to select multiple values, and I'll get them as "value1, value2,value3" in the backend, yes, that would work for me.

Re: Splunk Add-on - multi select values in an alert action

lakshman239 — Mon, 11 Feb 2019 16:51:39 GMT

when user selects multiple values, save them to a field in an index (which has concatenated values) and give this in your alert action [ one of the field].

Re: Splunk Add-on - multi select values in an alert action

shacharh — Mon, 11 Feb 2019 17:07:52 GMT

But I need to dynamically create those fields from a search results. Is this possible?

Re: Splunk Add-on - multi select values in an alert action

lakshman239 — Wed, 27 Feb 2019 10:24:39 GMT

Yes, thats possible. As you know what fields are possible (by dynamic selection), you can save them to a field and inside the modalert*.py, you can parse them and extract them to your needs.

Re: Splunk Add-on - multi select values in an alert action

shacharh — Wed, 27 Feb 2019 11:38:39 GMT

@lakshman239 but how can the user choose the fields? (he needs to choose some or all of them)

Re: Splunk Add-on - multi select values in an alert action

lakshman239 — Wed, 27 Feb 2019 12:01:34 GMT

As part of your add-on, I assume you are building a config page and alert UI (where you run a search and show fields in multi-select). The users select them and you save them to another field or index, which is passed as alert actions (pls check alert_actions.conf) and inside your modalert*.py you can then process them. Hope I am thinking along your requirements. If you are using Add-on builder, it will be easy.