topic Link to alert result needed as a variable in Alerting

Link to alert result needed as a variable

damucka — Fri, 19 Jun 2020 00:50:45 GMT

Hello,

I would like to get the link to the alert results under a variable, possibly already during the alert base search (at the end of it). Is it possible?
Basically I need sth like what I get from Activity --> Triggered Alerts --> View Results, e.g.:

https://splunk-ml.zone1.mo.sap.corp/en-US/app/mlbso/search?sid=scheduler__d046266__mlbso__RMD588cf20a54cf83ccb_at_1583910420_58750& ..... etc, etc.

but already at the end of the alert search, that I can set a variable out of it.
The reason is, that I need to integrate my alerts to another tool and there I have a very limited possibility of using texts, so there is no chance to build the output like in Splunk.
What I thought would be best, was to pass the link to the alert results that the alert processor can access splunk directly. For that I need this result link in some kind of variable set with eval ...

Is it possible?

Kind Regards,
Kamil

Re: Link to alert result needed as a variable

harsmarvania57 — Wed, 11 Mar 2020 09:12:26 GMT

Are you planning to use Custom Alert Action to send results to 3rd party tool ?

Re: Link to alert result needed as a variable

damucka — Wed, 11 Mar 2020 11:13:46 GMT

Yes, we wrote one in python and we choose it from the drop down list of the actions.

Kind Regards,
Kamil

Re: Link to alert result needed as a variable

harsmarvania57 — Wed, 11 Mar 2020 11:17:08 GMT

In Custom Alert action payload you can find results_link which contain Splunk Web Job result link . See example https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/ModAlertsBasicExample

Re: Link to alert result needed as a variable

damucka — Fri, 13 Mar 2020 11:57:11 GMT

Thank you.

Re: Link to alert result needed as a variable

damucka — Wed, 18 Mar 2020 11:25:50 GMT

Could you please convert your answer that I can accept it?

Re: Link to alert result needed as a variable

harsmarvania57 — Wed, 18 Mar 2020 11:56:59 GMT

Done, thanks.