Slack Alert Customization

[manish_singh_77]

Hi Team,

How do we pass link result of splunk alerts in slack from splunk?

[jkat54]

curl -X POST -H 'Content-type: application/json' --data '{"text":"Allow me to reintroduce myself!"}' YOUR_WEBHOOK_URL

[manish_singh_77]

@jkat54

How can we run this command from search head url from the search query?

[jkat54]

It's a Linux command you run from a command line shell.

[manish_singh_77]

@jkat54

I tried different slack channel that is using the same webhook url for testing purpose and there also we observed the delay in receiving alerts.

PFB error message that we see in the splunkd.log

ERROR SearchScheduler - Error in 'sendalert' command: Alert script returned error code 255., search='sendalert slack_webhook_alert results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_bXNpbmdoQGFybG8uY29t_c3BsdW5rX2FwcF9qZW5raW5z_RMD55de36a8bbf79c022_at_1580289000_23596_B2217163-89B0-464E-965F-D5D289E35131/results.csv.gz" results_link="********/app/splunk_app_jenkins/@go?sid=scheduler_bXNpbmdoQGFybG8uY29t_c3BsdW5rX2FwcF9qZW5raW5z_RMD55de36a8bbf79c022_at_1580289000_23596_B2217163-89B0-464E-965F-D5D289E35131"'

[jkat54]

If you try the curl command... which is what slack says to do to test your webhook...:

It will display any errors such as a rate limit