Alerting

How do you set up Slack alerts with Linux Hostname Environment Variable placeholder in alert_actions.conf?

sogeniusio
Path Finder

I'm setting up Slack alerts and would like to deploy uniformly to our heavy forwarders. To do so, I'd have to add a placeholder to their alert_actions.conf

[slack]
disabled = 0
param.from_user = XXXXXXXXXXXXXXXXXXX #$HOSTNAME or $HOST
param.webhook_url = https://hooks.slack.com/services/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

I was wondering if something like the linux hostname variable can be used within this file like above.

0 Karma

burwell
SplunkTrust
SplunkTrust

I would use the Splunkbase app Slack Notification Alert https://splunkbase.splunk.com/app/2878/#/overview. In the body of the alert you can use $result.host$
to refer to the hostname.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @sogeniusio,

Sorry you haven't received any answers to your question. I'm sure help is on the way!

But, in the mean time,If you want to try to get some immediate help for your question, you should join the 5000+ Splunk users in our public Slack Community chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it.

You first have to request access through https://splk.it/slack Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...