Alerting

Create Search Sending Multiline Slack Notification via Splunk API

short_cat
New Member

I would like to create a scheduled search sending multi-line Slack notification via Splunk API. 

I can create the search, there's no problem. Slack notification also works, but only limit to a single line notification. I would like to split the notification into multi-lines.

I am using "Slack Notification Alert" App and I have tried a few characters like "\n", "\r", "<br />", "\" and none of them worked. It seems that all of these are escaped and the Slack message is still a one-liner like

"test\ntest"

instead of

"test

test"

Of course I can use a browser to go to Splunk web UI and change it there but we need to do this in scale and changing it manually instead of via API is not efficient at all.

Please help, thanks a lot!

Slack Notification Alert

Labels (1)
0 Karma

meetmshah
Builder

Hello @short_cat, I don't think it's possible. I tried with makemv as well, something like - 

| makeresults 
| eval message = "This is line 1.\nThis is line 2.\nThis is line 3." 
| makemv message delim="\n"

But it's not sending the message as expected and just considering first line as below screenshot - 

meetmshah_0-1711780172182.png

meetmshah_1-1711780179893.png

I would suggest checking with the project contributors over GitHub - https://github.com/splunk/slack-alerts 🙂

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...