Alerting

Custom alert action parameter sets

diletoan
Explorer

I've got a custom alert action to RESTfully submitting a message to two different internal systems, and the quickest thing to do was to repeat sets of parameters:

param.endpoint_a = <string>
* The REST endpoint uri
param.endpoint_a_method = [get|post]
* HTTP verb to use

param.endpoint_b = <string>
param.endpoint_b_method = [get|post]

Can this be generalized, both in the .conf.spec and in the default/data/ui/ controls, so that I don't have to cut/paste/edit when a third (or fourth, or fifth) endpoint is introduced?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...