Create Search Sending Multiline Slack Notification via Splunk API

[short_cat]

I would like to create a scheduled search sending multi-line Slack notification via Splunk API. 

I can create the search, there's no problem. Slack notification also works, but only limit to a single line notification. I would like to split the notification into multi-lines.

I am using "Slack Notification Alert" App and I have tried a few characters like "\n", "\r", "<br />", "\" and none of them worked. It seems that all of these are escaped and the Slack message is still a one-liner like

"test\ntest"

instead of

"test

test"

Of course I can use a browser to go to Splunk web UI and change it there but we need to do this in scale and changing it manually instead of via API is not efficient at all.

Please help, thanks a lot!

Slack Notification Alert

[meetmshah]

Hello @short_cat, I don't think it's possible. I tried with makemv as well, something like - 

| makeresults 
| eval message = "This is line 1.\nThis is line 2.\nThis is line 3." 
| makemv message delim="\n"

But it's not sending the message as expected and just considering first line as below screenshot - 

I would suggest checking with the project contributors over GitHub - https://github.com/splunk/slack-alerts 🙂