Alerting

Need to send JSON structure from query results triggered from an Splunk Alert

maximusdm
Communicator

Hi there, I have an Splunk Alert which runs a query that returns a TABLE with 10 fields.
I need to send that data in a JSON structure to a Restful API which will read the JSON data and will parse it properly.

Is there a sample out there or solution for this? thank you

0 Karma
1 Solution

somesoni2
Revered Legend

I believe what you need is to setup webhook as alert action which can do POST to an external REST API endpoint. Have a look at this. (available in Splunk 6.3+)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks

View solution in original post

0 Karma

somesoni2
Revered Legend

I believe what you need is to setup webhook as alert action which can do POST to an external REST API endpoint. Have a look at this. (available in Splunk 6.3+)

http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks

0 Karma

maximusdm
Communicator

hi there, that does not seem to return the query results. That is what I need 😞

0 Karma

somesoni2
Revered Legend

I've not used it personally but it seems that the payload it sends contains the first row of the search result. How many search results that you get?

0 Karma

maximusdm
Communicator

correct it sends only the first row. I am using Alert mode: Once Per Result though.
I changed that to Once Per Search and instead of receiving 5 emails I get 1 email with all results.
However Webnook still sends only the first row. so it is useless for me. 😞

0 Karma

somesoni2
Revered Legend

Hmmm. Then a custom script might be a better option. May be in Python which can use search results (available in compression file, file path is sent to alert script as parameters) to generate necessary json (should be some libraries to do that) and send it to destination URL.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...