topic Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration in Alerting

Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

dwspncr — Fri, 21 Apr 2017 17:51:32 GMT

I have an Alert that successfully creates an entry in Trigger History via the "Add to Triggered Alerts" Trigger Action; however, the Webhook Trigger Action for the same Alert does not appear to fire.

The webhook URL (of the form https://hooks.slack.com/services/#########/#########/########################) is generated by Slack's Incoming WebHooks Custom Integration, and making a curl request to it is successful.

Any suggestions on how to debug this are appreciated.

Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

aaraneta_splunk — Fri, 21 Apr 2017 18:25:12 GMT

@dwspncr - Are you using the Slack Webhook Alert add-on in Splunkbase? Or a different Slack related app/add-on in Splunkbase? I just want to make sure your post is tagged appropriately for best visibility. Thank you.

Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

dwspncr — Fri, 21 Apr 2017 18:33:34 GMT

No add-ons. I was hoping to get it to work using a plain webhook post to Slack.

Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

chadwell — Wed, 17 May 2017 16:28:24 GMT

I'm hoping someone can answer this.

Using the provided 'webhook' functionality (without any additional apps etc) - how can we POST to a slack web hook.

I can use Postman on my laptop to post to the slack channel without issue. But when the splunk alert is triggered the webhook seems to do nothing.

Any ideas?>

Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

dwspncr — Thu, 18 May 2017 18:09:40 GMT

Using the Slack Webhook Alert add-on, as @aaraneta mentions, works.

I'm still not entirely satisfied, though, as all the documentation that I've read seem to indicate that "standard" webhooks should work.

Re: Alerts: Webhook Trigger Action and Slack Incoming WebHooks Custom Integration

known_user — Sat, 30 Sep 2017 12:59:07 GMT

How can we integrate without having to configure anything at the splunk enterprise level?