I am using the Slack Notification Alert app.
My saved search alert is set for Slack.
I want to send a message using the resulting value.
How can I replace it?
Hi geonspapa,
using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:
$result.my_field_name$
... where "my_field_name" is the name if a field in the search result.
Please have a look at the attached screenshot.
Regards,
Robert
Try changing the trigger action to "For each result" to get more than the first row.
is there any other way to get all events? By selection "For each result" i am getting all messages but it results in large number of messages on slack channel ie. will get 10 messages on slack channel for 10 events. I am looking to get only one slack message containing all 10 events.
Hi geonspapa,
using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:
$result.my_field_name$
... where "my_field_name" is the name if a field in the search result.
Please have a look at the attached screenshot.
Regards,
Robert
Is there a way to encapsulate fields that have spaces and pass to slack? I have several canned DMC alerts I'm working on sending over to slack. Just trying to figure out of I need to get rid of the rename statements which added spaces to the field names.
example:
| rename splunk_server AS Instance mount_point as "Mount Point", fs_type as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pct_usage as "Usage (%)"
I gave up trying to pass field names with spaces and just removed my rename
line that was giving me friendly names.
Is it possible to pass multiple results records?
As an example:
search:
index=* | head 100 | stats count by host sourcetype source
I put this in my slack alert but I only see one record:
$result.host$ $result.sourcetype$ $result.source$ $result.count$
See @russellliss 's answer.
Did you get solution for it? I had stuck at same place.