Why is Microsoft Teams Card not displaying the alert body?

New Member


I'm trying to setup some alerts using the Microsoft Teams Card add-on. 

So I installed the add-on, created a Teams channel and defined an alert which should be sent via a webhook whenever it is triggered. The problem I noticed is that the alerts are sent when the conditions are met but I can see only the title and the subtitle of the alert, not also the actual message/body which should be a custom text containing a log line.

This si how i defined the alert :



This is how i receive the alerts in Teams :



I can't figure out what i'm doing wrong. I mention i'm very new to Splunk.

Maybe the strcat function I use at the end of the query does not generate the apropriate output for the Teams add-on  ?

If i run the alert query in the "Search & Reporting" app i get good results: 





Labels (2)
0 Karma