Splunk Alert for Unused volumes in AWS

[dvarghes]

Hello,

I wanted write a splunk alert for unused volumes in AWS and send slack notification. Any suggestions on this ?

Regards,
Dennis

[manjunathmeti]

For sending slack notifications check this custom alert app.

https://splunkbase.splunk.com/app/2878/

[dvarghes]

I have configured slack notifications for AWS App alerts. However, the Slack notification does not contain search results. It contains only alert subject, result url, alert link etc.

Is there any way to add all search results along with the Slack notification ?

[manjunathmeti]

You can add $result.field_name1$, $result.field_name2$ in Message field where field_name1 and field_name2 are field names in you results. This will send field values from first row of your result.