Alerting

Link to alert result needed as a variable

damucka
Builder

Hello,

I would like to get the link to the alert results under a variable, possibly already during the alert base search (at the end of it). Is it possible?
Basically I need sth like what I get from Activity --> Triggered Alerts --> View Results, e.g.:

https://splunk-ml.zone1.mo.sap.corp/en-US/app/mlbso/search?sid=scheduler__d046266__mlbso__RMD588cf20... ..... etc, etc.

but already at the end of the alert search, that I can set a variable out of it.
The reason is, that I need to integrate my alerts to another tool and there I have a very limited possibility of using texts, so there is no chance to build the output like in Splunk.
What I thought would be best, was to pass the link to the alert results that the alert processor can access splunk directly. For that I need this result link in some kind of variable set with eval ...

Is it possible?

Kind Regards,
Kamil

Labels (1)
Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

In Custom Alert action payload you can find results_link which contain Splunk Web Job result link . See example https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/ModAlertsBasicExample

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

In Custom Alert action payload you can find results_link which contain Splunk Web Job result link . See example https://docs.splunk.com/Documentation/Splunk/8.0.2/AdvancedDev/ModAlertsBasicExample

0 Karma

damucka
Builder

Thank you.

0 Karma

damucka
Builder

Could you please convert your answer that I can accept it?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Done, thanks.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Are you planning to use Custom Alert Action to send results to 3rd party tool ?

0 Karma

damucka
Builder

Yes, we wrote one in python and we choose it from the drop down list of the actions.

Kind Regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...