topic Re: Custom Alert Action UI in Splunk Search

Custom Alert Action UI

astatrial — Wed, 30 Jan 2019 07:55:31 GMT

Hello!

I'm trying to append to the Alert ui the query itself (the search from which the user create the alert), in order to send it to another dashboard via link from the UI.

What i mean is that after a user will run a search, and will try to save it as an alert, the UI of the alert will contain a link to another dashboard with the search string.

I'm aware of the $search$ token but it doesn't seem to work.

Is this thing possible ?

Re: Custom Alert Action UI

eduardkiyko_ — Wed, 30 Jan 2019 08:08:29 GMT

I guess, its impossible, you should re-write Splunks source code to append custom ui

Re: Custom Alert Action UI

harishalipaka — Wed, 30 Jan 2019 08:13:36 GMT

@astatrial
try like this | return $linkfield

Re: Custom Alert Action UI

astatrial — Wed, 30 Jan 2019 09:28:52 GMT

where should i use it ?

Re: Custom Alert Action UI

harishalipaka — Wed, 30 Jan 2019 09:39:35 GMT

@astatrial

use in your query.can u share ur query

Re: Custom Alert Action UI

astatrial — Wed, 30 Jan 2019 10:13:42 GMT

I think i explained myself wrong.
I'm trying to configure the alert UI so it will capture the query from which it was created (before the alert is actually saved). This means that it needs to be generic to every query.

I want to be able to append a link to the UI that will transfer the query to outside dashboard.

There is example in the next picture.

Re: Custom Alert Action UI

astatrial — Wed, 30 Jan 2019 10:15:05 GMT

Please refer to the answer i posted.
i couldn't attach a picture here so i created an answer.

Thanks !

Re: Custom Alert Action UI

astatrial — Wed, 30 Jan 2019 12:58:02 GMT

I'm able to create the custom alert UI, i'm just trying to somehow send to the UI window of the "saving as an alert" the search string.