topic Re: How to configure POST request using webhook as an Alert Action? in Alerting

How to configure POST request using webhook as an Alert Action?

AKG1_old1 — Tue, 09 Jun 2020 21:51:35 GMT

Hello,

I am looking to configure POST request using webhook as an Alert action.

Issue is I am not sure how to configure all these details. I am only getting URL options.

Request Details:

-   URL: http://mule/issuesapi/v2/jiratst/projects/TI/issues
-   Method: POST
-   Credentials as Basic Authentication:
-   Username/Password: ***/***
-   Body

Request1:
{
  "summary": "Test to create TI issue from mule",
  "description": "Mule Testing Jira Api one level of Module",
  "type": "Incident",
  "priority": "3-Medium",
  "reporter": "ag",
  "moduleMapLevels":{"parent":"Common to All Modules"},
  "moduleMapAssets": [{"name":"Rates | IRD"},{"name":"CRD | CRD"}]
}

Re: How to configure POST request using webhook as an Alert Action?

harsmarvania57 — Thu, 14 Mar 2019 13:39:11 GMT

Hi @agoyal,

You can't send custom payload using Webhook alert action, it will by default send below payload (Check $SPLUNK_HOME/vetc/apps/alert_webhook/bin/webhook.py ) which contain Job SID, Search Name, App name, owner, Job Result link and Result.

settings = json.loads(sys.stdin.read())
url = settings['configuration'].get('url')
body = OrderedDict(
    sid=settings.get('sid'),
    search_name=settings.get('search_name'),
    app=settings.get('app'),
    owner=settings.get('owner'),
    results_link=settings.get('results_link'),
    result=settings.get('result')
)

Re: How to configure POST request using webhook as an Alert Action?

AKG1_old1 — Thu, 14 Mar 2019 14:04:53 GMT

Thanks @harsmarvania57 : Any idea if there is a way to send custom payload ?

Re: How to configure POST request using webhook as an Alert Action?

harsmarvania57 — Thu, 14 Mar 2019 19:25:37 GMT

Not with inbuilt webhook alert action, I’ll suggest you to create your own alert actions based on your requirement.

Re: How to configure POST request using webhook as an Alert Action?

jrizzo_splunk — Sat, 23 Mar 2019 14:41:10 GMT

Take a look at the following alert actions.
https://splunkbase.splunk.com/app/3226/

https://github.com/rzzldzzl/alert_webhook_ng

Joe

Re: How to configure POST request using webhook as an Alert Action?

nitsingh — Wed, 11 Sep 2019 19:11:25 GMT

Hi @harsmarvania57 ,

I am adding a webhook url http://myhosting.com/splunk_alert and I want to get the result from alert payload. I have nodejs api where I am listing to the post request

app.post('/splunk_alert', function(request, response){
  console.log(request.body);      // your JSON
   response.send(request.body);    // echo the result back
});

Am I getting this correct? is this how I can get the result from the request body from the splunk alert?

Thanks,
Nitin

Re: How to configure POST request using webhook as an Alert Action?

juliennerocafor — Mon, 04 May 2020 04:55:09 GMT

Hello, @agoyal . I would just like to ask if you were able to have some solutions with your question? Thank you!

Re: How to configure POST request using webhook as an Alert Action?

sivashanmugam — Thu, 06 May 2021 07:08:52 GMT

Hello harsmarvania57

Is it not possible to add more require field under $SPLUNK_HOME/vetc/apps/alert_webhook/bin/webhook.py ??

Re: How to configure POST request using webhook as an Alert Action?

harsmarvania57 — Fri, 07 May 2021 12:30:58 GMT

I'll suggest you to create new app based on your requirement. As far as I know alert_webhook is default app in Splunk so whenever you'll upgrade Splunk, script will revert back.