All Apps and Add-ons

Is it possible to use a $result.field$ token in Webhook alert?

Kimjong9
Engager

I was sending a alert using the teams app on the splunk base, which posts a card message to the teams. I want to send a plaintext message using webhook because the customer wants to receive a plaintext message rather than a card message. Can I use the $result.field$ token for the message content in the payload? I should use the fields in the search results table.
Goals
1. Post a plaintext message to msteams as a notification feature
2. Use the fields in the table of the notification search results as tokens

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Kimjong9 

Yes - you can use things like $result.yourFieldName$ in the payload of the message, however it cannot contain markdown or HTML - it will just be rendered as text.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Kimjong9
Engager

thank you for answer. I will try it

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...