All Apps and Add-ons

Slack Notification Alert: How can I get the message to use the resulting value from a saved search?

Explorer

I am using the Slack Notification Alert app.
My saved search alert is set for Slack.

I want to send a message using the resulting value.

How can I replace it?

1 Solution

Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "myfieldname" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

View solution in original post

Path Finder

Try changing the trigger action to "For each result" to get more than the first row.

Explorer

is there any other way to get all events? By selection "For each result" i am getting all messages but it results in large number of messages on slack channel ie. will get 10 messages on slack channel for 10 events. I am looking to get only one slack message containing all 10 events.

Splunk Employee
Splunk Employee

Hi geonspapa,

using the "Slack Notification Alert" app from Splunkbase (https://splunkbase.splunk.com/app/2878/ ), you can simply use the following pattern within the Slack message:

$result.my_field_name$

... where "myfieldname" is the name if a field in the search result.

Please have a look at the attached screenshot.

slack_alert_action

Regards,
Robert

View solution in original post

Motivator

Is there a way to encapsulate fields that have spaces and pass to slack? I have several canned DMC alerts I'm working on sending over to slack. Just trying to figure out of I need to get rid of the rename statements which added spaces to the field names.

example:
| rename splunkserver AS Instance mountpoint as "Mount Point", fstype as "File System Type", usage as "Usage (GB)", capacity as "Capacity (GB)", pctusage as "Usage (%)"

0 Karma

Explorer

I gave up trying to pass field names with spaces and just removed my rename line that was giving me friendly names.

0 Karma

Motivator

Is it possible to pass multiple results records?

As an example:

search:
index=* | head 100 | stats count by host sourcetype source

I put this in my slack alert but I only see one record:
$result.host$ $result.sourcetype$ $result.source$ $result.count$

0 Karma

Explorer

See @russellliss 's answer.

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Explorer

Did you get solution for it? I had stuck at same place.

0 Karma