Alerting

Splunk alerts wont go to Slack via Slack Webhook Alert

DR_GD
New Member

Hello everyone,

I want to send a Splunk alert to Slack channel. Below are the steps I have followed. However the alert wont be sent to Slack using the Slack Webhook Alert

  • I have created a Webhook in slack
  • Put it into Splunk alert.

Note

  1. Webhook is working as from other apps we are receiving alerts
  2. Alert is working as I have tested the same alert with email
  3. I have also not left the message field empty and it has ""  ( As advised by a previous Splunk post)

Kindly advise how I could resolve this issue.

 

Kind Regards,

DR_GD

Labels (2)
Tags (4)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi.  There are several apps on Splunkbase. The one we use is https://splunkbase.splunk.com/app/2878/

1) I got a Slack web hook and modify an alert_actions.conf

 

[slack]
param.webhook_url = https://hooks.slack.com/services/ABC12345/YYYYYY/xxxxxx

 

2) easy test is to just send to yourself.  My Slack username is myuser. It arrives as Slackbot in Slack.

 

| sendalert slack param.channel="@myuser" param.message="Friday test"

 

 3) And it works.  Look in  _audit

 

Audit:[timestamp=02-05-2021 22:03:32.419, user=myuser, action=search, info=granted , search_id='1612562612.438546_EC468701-9D5D-4C6B-B22C-9B179F397BB8', search='| sendalert slack param.channel="@myuser" param.message="Friday test"', autojoin='1', buckets=0, ttl=600, max_count=500000, maxtime=8640000, enable_lookups='1', extra_fields='', apiStartTime='Fri Feb  5 21:48:32 2021', apiEndTime='Fri Feb  5 22:03:32 2021', savedsearch_name=""][n/a]

 

 

Furthermore if I specified a bad username or bad slack channel

 

| sendalert slack param.channel="#nosuchchannel" param.message="Friday test"

 

I get an error in the browser

Error in 'sendalert' command: Alert script returned error code 5.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

If you look in the job inspector you can see the actual error

 

2-05-2021 22:08:21.401 INFO  sendmodalert - action=slack STDERR -  Running python 3
02-05-2021 22:08:21.401 WARN  sendmodalert - action=slack STDERR -  Validation warning: Parameter `attachment` must be ether "alert_link" or "message"
02-05-2021 22:08:21.401 INFO  sendmodalert - action=slack STDERR -  Using configured webhook URL: https://hooks.slack.com/services/T025DU6HX/BBLUA59Q9/xxxxxx
02-05-2021 22:08:21.401 ERROR sendmodalert - action=slack STDERR -  HTTP request to Slack webhook URL failed: HTTP Error 404: Not Found
02-05-2021 22:08:21.401 ERROR sendmodalert - action=slack STDERR -  Slack error response: b'channel_not_found'
02-05-2021 22:08:21.401 FATAL sendmodalert - action=slack STDERR -  Alert action failed
02-05-2021 22:08:21.407 INFO  sendmodalert - action=slack - Alert action script completed in duration=230 ms with exit code=5
02-05-2021 22:08:21.407 WARN  sendmodalert - action=slack - Alert action script returned error code=5
02-05-2021 22:08:21.446 ERROR sendmodalert - Error in 'sendalert' command: Alert script returned error code 5.

 


 

Tags (1)
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...