Alerting

Need to send JSON structure from query results triggered from an Splunk Alert

maximusdm
Communicator

Hi there, I have an Splunk Alert which runs a query that returns a TABLE with 10 fields.
I need to send that data in a JSON structure to a Restful API which will read the JSON data and will parse it properly.

Is there a sample out there or solution for this? thank you

0 Karma
1 Solution

somesoni2
Revered Legend

I believe what you need is to setup webhook as alert action which can do POST to an external REST API endpoint. Have a look at this. (available in Splunk 6.3+)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks

View solution in original post

0 Karma

somesoni2
Revered Legend

I believe what you need is to setup webhook as alert action which can do POST to an external REST API endpoint. Have a look at this. (available in Splunk 6.3+)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks

0 Karma

maximusdm
Communicator

hi there, that does not seem to return the query results. That is what I need 😞

0 Karma

somesoni2
Revered Legend

I've not used it personally but it seems that the payload it sends contains the first row of the search result. How many search results that you get?

0 Karma

maximusdm
Communicator

correct it sends only the first row. I am using Alert mode: Once Per Result though.
I changed that to Once Per Search and instead of receiving 5 emails I get 1 email with all results.
However Webnook still sends only the first row. so it is useless for me. 😞

0 Karma

somesoni2
Revered Legend

Hmmm. Then a custom script might be a better option. May be in Python which can use search results (available in compression file, file path is sent to alert script as parameters) to generate necessary json (should be some libraries to do that) and send it to destination URL.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...