Other Usage

How to send table format query result from Splunk to Slack?

skumarr
New Member

Screenshot 2023-04-30 at 12.40.33 PM.png

 

I have a requirement where i want send the above query result from splunk to slack as an FYI alert. But somehow i am not able to achieve it and i am unable find the right documents to processed. I did try to print using  $result.req$ $result.method$ and $result.percentile99$ but i get to see the slack message for just 1st row. 
But i would need the complete query to be shown in slack message. How do i achieve this ?

 

@ITWhisperer or anyone please help me out here

Tags (1)
0 Karma

skumarr
New Member

Can you help me with some examples @PickleRick  on how to return list of rows into 1 single row and get that displayed in slack

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It really depends on what you want to achieve but the easiest thing for starters would be to do

| stats values(*) as *

 

0 Karma

burwell
SplunkTrust
SplunkTrust

Yes so you can only refer to field names but not get multiple values of a field so you need to use stats or eval to create the fields you want 

So like @PickleRick suggests 

stats values(*) AS *

And then use the actual fieldname in the body of the Slack alert eg $yourfield$

Here are more ideas https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-custom-alert-message-with-variables/m-...

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I don't know this particular add-on so I'm only speculating here but it is possible that the action allows only sending a single row from the results. In that case you'd have to either modify the script to include more rows (which might be tricky and will give you additional maintenance burden in the future) or you can rework your search to return values in a single row (possibly using multivalued fields)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...