All Apps and Add-ons

Slack Notification Alert: How can I get the message to use the resulting value from a saved search?

geonspapa
Explorer

I am using the Slack Notification Alert app.
My saved search alert is set for Slack.

I want to send a message using the resulting value.

How can I replace it?

1 Solution

rfujara_splunk
Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "my_field_name" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

View solution in original post

russellliss
Path Finder

Try changing the trigger action to "For each result" to get more than the first row.

akchauhan
Explorer

is there any other way to get all events? By selection "For each result" i am getting all messages but it results in large number of messages on slack channel ie. will get 10 messages on slack channel for 10 events. I am looking to get only one slack message containing all 10 events.

rfujara_splunk
Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "my_field_name" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

bandit
Motivator

Is there a way to encapsulate fields that have spaces and pass to slack? I have several canned DMC alerts I'm working on sending over to slack. Just trying to figure out of I need to get rid of the rename statements which added spaces to the field names.

example:
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"

0 Karma

joshualarkins
Explorer

I gave up trying to pass field names with spaces and just removed my rename line that was giving me friendly names.

0 Karma

bandit
Motivator

Is it possible to pass multiple results records?

As an example:

search:
index=* | head 100 | stats count by host sourcetype source

I put this in my slack alert but I only see one record:
$result.host$ $result.sourcetype$ $result.source$ $result.count$

0 Karma

joshualarkins
Explorer

See @russellliss 's answer.

0 Karma

rajuljain2605
Explorer

Did you get solution for it? I had stuck at same place.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...