Slack Notification Alert: Any way to send an inline table like email alert does?

[worshamn]

I think I know the answer but I was hoping it wasn't so. Is there any way to send an inline table to Slack as part of the alert action from Slack Notification Alert app similar to how email alerts have that option? I know you could send a slack per result, but that would look ugly and not communicate what a table could say. I have used the slackit app which can send a text table, however it does not have an alert action like this app does (because I want to only send if there exist results).

[richard_wilhite]

The issue is one part Slack formatting one part splunk data, I believe. I was also looking at this the other day, and here are some links that might help you.

• https://splunkbase.splunk.com/app/3277/#/overview
• https://api.slack.com/docs/message-attachments

I didn't dig much further. What I wanted to post in Slack, didn't seem to justify the time a full solution would require. However, this may make for a nice project over the winter break.

[nadlurinadluri]

I know this is too old, but any luck with this?

[russellliss]

Have you tried to use the $result.fieldname$ token, and change the trigger to "For each result", otherwise you will just get the first row?

[worshamn]

When I said "I know you could send a slack per result" I was referring to "For each result". But as I mentioned that would really look ugly in Slack and not communicate as well what a table can say.

[manish_singh_77]

@worshamn

Is there no way we can add inline table results of Splunk query to Slack messenger?

[nadlurinadluri]

The best way would be to make it a multivalued and send the first event alone. that way the first row will consists the other data too.

[worshamn]

I so far only know of an older app that was archived which creates a text table in Slack https://splunkbase.splunk.com/app/2784/