Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Slack alert not sending?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi guys,
I have four Slack alerts that are not sending to their specified channels, but other of my Slack alerts are working. Why would this be?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your message field cannot be empty. You must specify " " or put some other value in there for a message. This is either 1) a bug or 2) intended functionality, which makes no sense, because EVERY other Slack integration besides Splunk just lets you pump the data out directly. If 2) is indeed the case, and for some bizarre reason this is intended functionality, there should at least be an error message instead of just letting you save the alert which will be secretly not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nick405060 Hi there,
unfortunately, I haven't been working with Splunk a lot and to my shame, the Slack alert app has been slipping a bit.
I will have to dig into the reason why I had the message field mandatory and if that's the case, why it doesn't warn when it is actually empty.
Might well be a bug. But I can't say right now.
I will keep you posted.
Best regards,
Johan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One other issue: the specified whitespace " " to fix this issue gets wiped on reboot. So the integrations get disabled upon reboot
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your message field cannot be empty. You must specify " " or put some other value in there for a message. This is either 1) a bug or 2) intended functionality, which makes no sense, because EVERY other Slack integration besides Splunk just lets you pump the data out directly. If 2) is indeed the case, and for some bizarre reason this is intended functionality, there should at least be an error message instead of just letting you save the alert which will be secretly not working.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
