How to configure POST request using webhook as an Alert Action?

[AKG1_old1]

Hello,

I am looking to configure POST request using webhook as an Alert action.

Issue is I am not sure how to configure all these details. I am only getting URL options.

Request Details:

-   URL: http://mule/issuesapi/v2/jiratst/projects/TI/issues
-   Method: POST
-   Credentials as Basic Authentication:
-   Username/Password: ***/***
-   Body

Request1:
{
  "summary": "Test to create TI issue from mule",
  "description": "Mule Testing Jira Api one level of Module",
  "type": "Incident",
  "priority": "3-Medium",
  "reporter": "ag",
  "moduleMapLevels":{"parent":"Common to All Modules"},
  "moduleMapAssets": [{"name":"Rates | IRD"},{"name":"CRD | CRD"}]
}

[harsmarvania57]

Hi @agoyal,

You can't send custom payload using Webhook alert action, it will by default send below payload (Check $SPLUNK_HOME/vetc/apps/alert_webhook/bin/webhook.py ) which contain Job SID, Search Name, App name, owner, Job Result link and Result.

settings = json.loads(sys.stdin.read())
url = settings['configuration'].get('url')
body = OrderedDict(
    sid=settings.get('sid'),
    search_name=settings.get('search_name'),
    app=settings.get('app'),
    owner=settings.get('owner'),
    results_link=settings.get('results_link'),
    result=settings.get('result')
)

[sivashanmugam]

Hello harsmarvania57 

 Is it not possible to add more require field under $SPLUNK_HOME/vetc/apps/alert_webhook/bin/webhook.py ??

[harsmarvania57]

I'll suggest you to create new app based on your requirement. As far as I know alert_webhook is default app in Splunk so whenever you'll upgrade Splunk, script will revert back.

[AKG1_old1]

Thanks @harsmarvania57 : Any idea if there is a way to send custom payload ?

[juliennerocafor]

Hello, @agoyal . I would just like to ask if you were able to have some solutions with your question? Thank you!

[jrizzo_splunk]

Take a look at the following alert actions.
https://splunkbase.splunk.com/app/3226/

https://github.com/rzzldzzl/alert_webhook_ng

Joe

[nitsingh]

Hi @harsmarvania57 ,

I am adding a webhook url http://myhosting.com/splunk_alert and I want to get the result from alert payload. I have nodejs api where I am listing to the post request

app.post('/splunk_alert', function(request, response){
  console.log(request.body);      // your JSON
   response.send(request.body);    // echo the result back
});

Am I getting this correct? is this how I can get the result from the request body from the splunk alert?

Thanks,
Nitin

[harsmarvania57]

Not with inbuilt webhook alert action, I’ll suggest you to create your own alert actions based on your requirement.