- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I add .json in slack messages from Splunk?

jtlittle
Path Finder
02-14-2018
05:44 PM
I have this App.
https://splunkbase.splunk.com/app/3525/#/details
Almost everyone does and I don't see how I can add my .json into the message body so this active action has my Splunk search results link or RAW log in the .json message. There must be a TAG I am not using because the script in this App has the JSON library in the code.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sjodle
Path Finder
02-15-2018
07:08 AM
The Slack Webhook Alert supports the same inline tokens as the email alert, as detailed in https://docs.splunk.com/Documentation/Splunk/7.0.2/Alert/EmailNotificationTokens.
For example, for your license usage example, if your search returns a results with a usage_gb
field, you can set your Slack message as follows:
We used $result.usage_gb$ GB of our license today.
Hope this helps.
