Need to send JSON structure from query results triggered from an Splunk Alert

[maximusdm]

Hi there, I have an Splunk Alert which runs a query that returns a TABLE with 10 fields.
I need to send that data in a JSON structure to a Restful API which will read the JSON data and will parse it properly.

Is there a sample out there or solution for this? thank you

[somesoni2 · Accepted solution]

I believe what you need is to setup webhook as alert action which can do POST to an external REST API endpoint. Have a look at this. (available in Splunk 6.3+)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks

[maximusdm]

hi there, that does not seem to return the query results. That is what I need 😞

[somesoni2]

I've not used it personally but it seems that the payload it sends contains the first row of the search result. How many search results that you get?

[maximusdm]

correct it sends only the first row. I am using Alert mode: Once Per Result though.
I changed that to Once Per Search and instead of receiving 5 emails I get 1 email with all results.
However Webnook still sends only the first row. so it is useless for me. 😞

[somesoni2]

Hmmm. Then a custom script might be a better option. May be in Python which can use search results (available in compression file, file path is sent to alert script as parameters) to generate necessary json (should be some libraries to do that) and send it to destination URL.