Alerting

Webhook alert action: Why am I unable to specify a header, and if I run the alert once per result, will it have different results on each post?

ramabu
Path Finder

A.
I suppose I can put the authorization token in the URL as param, but I expected to be able to specify a header.
I suppose this is not really an issue, still asking - why?

B.
The json in the webhook splunkbase document http://docs.splunk.com/Documentation/Splunk/6.3.0/Alert/Webhooks contains one result, first.

If I run the alert once per result - will it have different results on each post?
If not, then how to pass the full result set to the Servlet?

0 Karma
1 Solution

ramabu
Path Finder

No headers: That's by definition. The built-in webhook.py is for simple, no-header no-auth, interactions.
As to 'once-per-result" - yes, The single result attached to the webhook is each actual result out of the result set.

View solution in original post

0 Karma

ramabu
Path Finder

No headers: That's by definition. The built-in webhook.py is for simple, no-header no-auth, interactions.
As to 'once-per-result" - yes, The single result attached to the webhook is each actual result out of the result set.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...