topic Re: Can we setup alerts using REST API, with action to send a POST request at a webhook? in Alerting

Can we setup alerts using REST API, with action to send a POST request at a webhook?

bhavneet91 — Tue, 09 Jun 2020 01:14:04 GMT

We want to setup alerts using REST API.
https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches described how we can do it with POST request to /saved/searches.

But this only talks about email as action. Can we have action as call to a webhook when the alert is set up through REST API.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

harsmarvania57 — Tue, 04 Sep 2018 08:57:59 GMT

Hi @bhavneet91,

Yes you can use below REST API to enable Weblook alert actions on scheduled search.

curl -k -u admin:pass https://localhost:8089/servicesNS/<USER>/<APP>/saved/searches/MySavedSearch -d actions=webhook -d action.webhook.param.url="https://your.server.com/api/v1/webhook"

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

mstjohn_splunk — Tue, 04 Sep 2018 18:11:25 GMT

hi @bhavneet91,

Did you get a chance to try @bhavneet91 's solution? If so, would you mind approving the answer below? Or, if it didn't work, go ahead and post some more details about your issue.

Thanks for posting!

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

bhavneet91 — Wed, 05 Sep 2018 05:58:15 GMT

Surprised why it is not there available on the documentation.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

santosh_sshanbh — Mon, 18 Feb 2019 10:30:58 GMT

How I can pass any other parameters to my POST method using this approach?

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

juliennerocafor — Thu, 30 Apr 2020 07:11:28 GMT

Hello @santosh_sshanbhag , I would just like to ask if you were able to have a solution for your inquiry?

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

santosh_sshanbh — Thu, 30 Apr 2020 07:27:48 GMT

No, ultimately I have to write a python script to create a object and set all its properties before I call the POST method.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

sddunne — Fri, 19 Jun 2020 16:32:18 GMT

HI there, i tried to use this and i get an error saying;

curl -k -u<removedforsecurity>:<removedforsecurity> https://<removedforsecurity>.splunkcloud.com:8089/servicesNS/cmpapi/search/saved/searches/seantest-CreateAccessKey -d actions=webhook -d action.webhook.param.url="https://your.server.com/api/v1/webhook"

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "action.webhook.param.url" is not supported by this handler.</msg>
</messages>
</response>

No matter what i try i get the unsupported error. This is on a Splunk Cloud instance. Is this accurate or is there another way of creating an alert with a webhook action?

Many thanks!

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

sddunne — Thu, 02 Jul 2020 14:24:59 GMT

Hey @harsmarvania57 ,

I tried to use this (against our splunk cloud instance) and i get an error saying;

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Argument "action.webhook.param.url" is not supported by this handler.</msg>
</messages>
</response>

No matter what i try i get the unsupported error. This is on a Splunk Cloud instance. Is this accurate or is there another way of creating an alert with a webhook action?

Many thanks!

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

harsmarvania57 — Thu, 09 Jul 2020 09:16:31 GMT

@sddunne Is this report or alert ?

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

sddunne — Mon, 13 Jul 2020 13:20:56 GMT

Hey @harsmarvania57 , it's an alert.

I'm trying to programatically create alerts with a webhook action. When we onboard a new service, we set up a dedicated index and would like to be able to deploy our standard set of alerts as part of the onboarding process (we currently set up all the alerts manually in the console).

Many thanks,
Sean.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

harsmarvania57 — Tue, 14 Jul 2020 10:46:17 GMT

Is it possible you to provide how are you creating alert ? Also it will be good to create new question and refer this link in that question.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

sddunne — Tue, 14 Jul 2020 16:28:47 GMT

Hi @harsmarvania57 ,

I found the problem, it was generating them as reports and so they were not showing up in the console in the 'alerts' section.

Do you know what i need to set on the report to make it show up as an alert?

Sean.

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

sandeepduppalli — Sun, 11 Oct 2020 08:07:38 GMT

Will the type be create as "Report" or "Alert"..?? There are two types one is "Report" and another is "Alert". I have create a saved search, created its schedule etc.. but the type is still "Report". How to do it for "Alert" type??

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

Jknike — Thu, 10 Jun 2021 21:49:13 GMT

Hi Santosh,

Is it possible for you to share the python script you created. I have something similar to be done for one of my clienst

Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?

siddhant — Fri, 16 Jul 2021 02:55:26 GMT

Did you find out how can we save it as alert? A new report is getting created.