Alerting

Filter data sended using saved search with action webhook or email action

TISKAR
Builder

Hello Splunker's

I programmed a saved search with a send webhook data action to send the result in json format. I noticed that the data sent contains additional information like app name eand result_link:

INFO -: {"app" => "search", "results_link" => "http: // splk-sh: 8000 / app / search / search? ....

In fact, I don't want to display this information on my results; i searched in advanced actions i found:

action.webhook.command: sendalert $action_name$ results_file="$results.file$" results_link="$results.url$"

i tried to delete result_link but it doesn't work. 

did you encounter this problem on whebook or even email action can be the same.

Thank you

Labels (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...