All Apps and Add-ons

Is it possible to use a $result.field$ token in Webhook alert?

Kimjong9
Engager

I was sending a alert using the teams app on the splunk base, which posts a card message to the teams. I want to send a plaintext message using webhook because the customer wants to receive a plaintext message rather than a card message. Can I use the $result.field$ token for the message content in the payload? I should use the fields in the search results table.
Goals
1. Post a plaintext message to msteams as a notification feature
2. Use the fields in the table of the notification search results as tokens

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Kimjong9 

Yes - you can use things like $result.yourFieldName$ in the payload of the message, however it cannot contain markdown or HTML - it will just be rendered as text.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Kimjong9
Engager

thank you for answer. I will try it

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...