Slack Notification Alert: How can I get the message to use the resulting value from a saved search?

[geonspapa]

I am using the Slack Notification Alert app.
My saved search alert is set for Slack.

I want to send a message using the resulting value.

How can I replace it?

[russellliss]

Try changing the trigger action to "For each result" to get more than the first row.

[akchauhan]

is there any other way to get all events? By selection "For each result" i am getting all messages but it results in large number of messages on slack channel ie. will get 10 messages on slack channel for 10 events. I am looking to get only one slack message containing all 10 events.

[rfujara_splunk · Accepted solution]

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "my_field_name" is the name if a field in the search result.

Please have a look at the attached screenshot.

Regards,
Robert

[bandit]

Is there a way to encapsulate fields that have spaces and pass to slack? I have several canned DMC alerts I'm working on sending over to slack. Just trying to figure out of I need to get rid of the rename statements which added spaces to the field names.

example:
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

[joshualarkins]

I gave up trying to pass field names with spaces and just removed my rename line that was giving me friendly names.

[bandit]

Is it possible to pass multiple results records?

As an example:

search:
index=* | head 100 | stats count by host sourcetype source

I put this in my slack alert but I only see one record:
$result.host$ $result.sourcetype$ $result.source$ $result.count$

[joshualarkins]

See @russellliss 's answer.

[rfujara_splunk]

Have a look at http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro#About_token_replacement...

[rajuljain2605]

Did you get solution for it? I had stuck at same place.