Alerting

Create Search Sending Multiline Slack Notification via Splunk API

short_cat
New Member

I would like to create a scheduled search sending multi-line Slack notification via Splunk API. 

I can create the search, there's no problem. Slack notification also works, but only limit to a single line notification. I would like to split the notification into multi-lines.

I am using "Slack Notification Alert" App and I have tried a few characters like "\n", "\r", "<br />", "\" and none of them worked. It seems that all of these are escaped and the Slack message is still a one-liner like

"test\ntest"

instead of

"test

test"

Of course I can use a browser to go to Splunk web UI and change it there but we need to do this in scale and changing it manually instead of via API is not efficient at all.

Please help, thanks a lot!

Slack Notification Alert

Labels (1)
0 Karma

meetmshah
Builder

Hello @short_cat, I don't think it's possible. I tried with makemv as well, something like - 

| makeresults 
| eval message = "This is line 1.\nThis is line 2.\nThis is line 3." 
| makemv message delim="\n"

But it's not sending the message as expected and just considering first line as below screenshot - 

meetmshah_0-1711780172182.png

meetmshah_1-1711780179893.png

I would suggest checking with the project contributors over GitHub - https://github.com/splunk/slack-alerts 🙂

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...